EUVD-2026-53871
GHSA-394j-mpf4-9p7j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible but PR:L required per CVSS 4.0 source; integrity-only impact (I:L) with no confidentiality or availability effects, unchanged scope.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::update_lob of the file src/WtBtCore/MatchEngine.cpp of the component Internal Limit Order Book Cache Handler. This manipulation causes enforcement of behavioral workflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Business logic enforcement failure in WonderTrader's backtesting engine (versions up to 0.9.9) allows a low-privileged authenticated remote attacker to manipulate the internal limit order book cache through the MatchEngine::update_lob function in src/WtBtCore/MatchEngine.cpp. The flaw enables integrity-affecting manipulation of simulated or processed order book state in violation of expected matching workflow constraints. No vendor patch exists - the vendor did not respond to responsible disclosure - and proof-of-concept exploit code is publicly available (CVSS 4.0 E:P), though real-world risk is substantially bounded by the authentication requirement, low-only integrity impact, and niche deployment footprint.
Technical ContextAI
WonderTrader is an open-source C++ quantitative trading and backtesting framework primarily used in algorithmic trading research and strategy development, predominantly within Chinese fintech communities. The affected component, WtBtCore, is the backtesting engine core. Within it, the MatchEngine class simulates order matching against a Limit Order Book (LOB) - a data structure tracking outstanding bid and ask orders. The update_lob function is responsible for updating this internal LOB cache as new order events arrive. CWE-840 (Business Logic Errors) describes flaws where software fails to enforce its intended operational workflow - in this case, the function can be triggered in ways that bypass the expected sequencing or validation rules governing order book updates, allowing an attacker to push the cache into an inconsistent or manipulated state. No CPE string is available in the provided intelligence data.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure, leaving no confirmed fix version or remediation timeline. Organizations running WonderTrader 0.9.9 or earlier should immediately restrict network access to the MatchEngine API or any interface layer that exposes the WtBtCore backtesting component, ensuring only explicitly trusted and authorized low-privilege users can reach it; this does not eliminate the vulnerability but raises the exploitation bar by reducing attacker surface. Since the affected component is specifically the backtesting core, isolating backtesting environments from production trading infrastructure is a high-value compensating control with minimal operational trade-off. Apply strict authentication and access controls to the WonderTrader instance as a whole. Monitor for anomalous order book state changes as a detection measure. Watch VulDB entry https://vuldb.com/vuln/386456 for patch availability updates and upgrade immediately upon a patched release being published.
Same weakness CWE-840 – Business Logic Errors
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today