The Wallet for WooCommerce plugin contains an authorization bypass in its terawallet_export_user_search AJAX handler. An attacker who is authenticated with a Subscriber role or higher can supply arbitrary search terms and receive login names, e‑mail addresses, and user IDs for every WordPress account, including administrators. The vulnerability stems from the absence of a proper capability check before executing the action and is classified as CWE-862.

All releases of SubraMal’s Wallet for WooCommerce up to and including version 1.6.4 are impacted. The CVE data explicitly states that the missing authorization check applies to every build before the plugin’s subsequent patch. No further version available data.

The CVSS score of 4.3 indicates a moderate impact, while the EPSS score of less than 1% suggests that large‑scale exploitation is currently unlikely. The vulnerability is not listed in the KEV. Attackers need only be authenticated as at least a Subscriber and can obtain the required ‘search‑user’ nonce from the My Account page, making the exploitation process straightforward for those users.