Concurrent execution using a shared resource without proper synchronization was identified in Subrata Mal’s TeraWallet – For WooCommerce plugin (versions up to 1.5.15). The issue is a classic race condition (CWE‑362) that can allow an attacker to interfere with the normal sequence of operations, potentially leading to data corruption or unpredictable behavior. The advisory does not describe a direct threat to confidentiality or integrity beyond these inconsistencies.

The vulnerability affects the WordPress plugin ‘TeraWallet – For WooCommerce’ developed by Subrata Mal. All releases from the earliest version through version 1.5.15 are impacted; any deployment of the plugin at or below 1.5.15 is potentially vulnerable.

The CVSS score is 5.3, indicating a moderate impact. The EPSS score is less than 1%, suggesting a low likelihood of exploitation at this time. The vulnerability is not currently listed in the CISA KEV catalog. Because the flaw requires concurrent access to shared data, the likely attack vector is local or involves a privileged user creating two parallel requests; the exact external exploitation path is not explicitly documented in the provided information.