This vulnerability in WonderTrader up to version 0.9.9 affects the _undone_qty function within the Pending Order Handler component (src/WtCore/TraderAdapter.h). Manipulating the getUndoneQty argument results in enforcement of behavioral workflow, which is a security concern. The attack vector is network-based with low attack complexity and no privileges required. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity). Public exploit code exists, but there is no evidence of active exploitation. The vendor has not provided any response or patch, and remediation level is unknown.

An attacker can remotely manipulate the getUndoneQty argument to influence the behavioral workflow enforcement in WonderTrader's Pending Order Handler. This could potentially disrupt normal order processing behavior. The vulnerability requires no user interaction and low privileges, increasing the risk of exploitation. However, the impact is limited to workflow enforcement without evidence of data confidentiality, integrity, or availability compromise. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for vendor updates and consider applying any future patches promptly. Until a fix is released, restricting network access to the affected component and applying compensating controls may reduce exposure.