CVE-2024-1690

CVE-2024-1690 affects the TeraWallet plugin for WordPress, specifically versions up to and including 1.4.10. This vulnerability, a missing capability check in the terawallet_export_user_search() function, allows authenticated attackers with subscriber-level access to export a list of registered users and their email addresses. Rated as Medium severity (CVSS 4.3), the vulnerability has a low attack complexity and requires only low privileges to exploit, leading to a potential compromise of user data confidentiality. There is no impact on integrity or availability. Currently, there is no evidence of active exploitation, nor are there any publicly available exploit modules or proof-of-concept code. The vulnerability has received minimal community discussion or media coverage, suggesting low public awareness.