This vulnerability in WonderTrader up to version 0.9.9 allows remote attackers to manipulate the FID_JYLB argument in the TraderDD::queryTrades function, causing enforcement of behavioral workflow. The attack vector is network-based with high complexity and no privileges or user interaction required. The CVSS 4.0 base score is 6.3 (medium severity). Although exploit code is public, no official patch or remediation guidance has been provided by the vendor, who has not responded to disclosure attempts.

Successful exploitation could allow remote attackers to enforce behavioral workflow in the affected function, potentially impacting the normal operation of the trading system. The exact impact beyond this enforcement is not detailed. The attack complexity is high, and no privileges or user interaction are required, limiting the ease of exploitation. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the vendor. Due to the high complexity of exploitation, immediate urgent mitigation may not be necessary, but caution is advised.