EUVD-2026-54559
GHSA-22gg-289x-58qq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with low complexity; PR:L required per CVSS 4.0 source vector; impact is exclusively low integrity modification with no confidentiality or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in WonderTrader up to 0.9.9. Affected is the function _undone_qty in the library src/WtCore/TraderAdapter.h of the component Pending Order Handler. The manipulation of the argument getUndoneQty leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Behavioral workflow enforcement bypass in WonderTrader up to version 0.9.9 allows remote low-privileged attackers to manipulate the getUndoneQty argument within the _undone_qty function of the Pending Order Handler component (src/WtCore/TraderAdapter.h), resulting in unauthorized integrity modification of pending order state. The CVSS 4.0 vector confirms network-accessible exploitation with low privilege requirements and no user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires low-privilege authenticated access to the WonderTrader instance (confirmed by PR:L in the CVSS 4.0 vector) - unauthenticated exploitation is not supported by available data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) reflects a constrained but real threat profile: network-accessible (AV:N), low complexity (AC:L), no attack prerequisites (AT:N), but requiring low-privilege authentication (PR:L), with only low integrity impact on the vulnerable system (VI:L) and no confidentiality or availability effect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis - the vendor did not respond to disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wondertrader
View allImproper behavioral workflow enforcement in WonderTrader up to version 0.9.9 allows remote attackers to manipulate the F
Use of an uninitialized variable in WonderTrader up to version 0.9.9 allows a remote low-privileged attacker to cause li
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today