This vulnerability in WonderTrader up to version 0.9.9 involves the TraderDD::queryTrades function where manipulation of the FID_JYLB argument leads to enforcement of behavioral workflow. The vulnerability is remotely exploitable but requires high attack complexity and no privileges or user interaction. The CVSS 4.0 base score is 6.3 (medium severity). The vendor was contacted but has not issued any advisory or patch. Exploit code is publicly available, increasing risk despite difficulty of exploitation.

Successful exploitation can enforce behavioral workflow remotely, potentially impacting the normal operation of the TraderDD::queryTrades function. The medium CVSS score reflects moderate impact with no privileges required and no user interaction needed. The exploitability is difficult, which may limit widespread exploitation. There is no indication of privilege escalation, data confidentiality loss, or system compromise beyond the described behavioral enforcement.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded or issued a fix, users should consider mitigating exposure by restricting remote access to affected versions of WonderTrader (0.9.0 through 0.9.9) and monitoring for exploit attempts. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance if it becomes available.