CVE-2026-19037

Deferred Deferred - Pending Action

WonderTrader Internal Limit Order Book Cache Handler Workflow Bypass

Publication date: 2026-08-06

Last updated on: 2026-08-12

Assigner: VulDB

Description

A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::update_lob of the file src/WtBtCore/MatchEngine.cpp of the component Internal Limit Order Book Cache Handler. This manipulation causes enforcement of behavioral workflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-12

Generated

2026-08-16

AI Q&A

2026-08-06

EPSS Evaluated

2026-08-15

NVD

CVE-2026-19037

EUVD

EUVD-2026-53871

Affected Vendors & Products

Vendor	Product	Version / Range
wondertrader	wondertrader	to 0.9.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-840	Business Logic Errors
CWE-841	The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

Attack-Flow Graph

Executive Summary

This vulnerability is in WonderTrader up to version 0.9.9, specifically in the MatchEngine::update_lob function of the Internal Limit Order Book Cache Handler component. It allows attackers to manipulate the system's behavior by enforcing a specific workflow. The issue is exploitable remotely and a public exploit is available.

Detection Guidance

Detection requires monitoring for unusual behavior in the MatchEngine::update_lob function of WonderTrader's Internal Limit Order Book Cache Handler. Check for unexpected workflow enforcement or remote access attempts targeting this component.

Impact Analysis

An attacker could exploit this to manipulate trading behavior, potentially causing incorrect order matching or cache handling. This may lead to financial losses, disrupted trading operations, or unauthorized trading activities if exploited by malicious actors.

Compliance Impact

The provided CVE data does not specify any direct impact on compliance with standards like GDPR or HIPAA. The vulnerability involves enforcement of behavioral workflow in WonderTrader's Internal Limit Order Book Cache Handler, which may lead to unauthorized behavior but lacks explicit compliance-related consequences in the given context.

Mitigation Strategies

Immediately upgrade WonderTrader to a version beyond 0.9.9 if available. If no patch exists, isolate the affected component MatchEngine::update_lob in src/WtBtCore/MatchEngine.cpp. Monitor network traffic for unusual behavior related to Internal Limit Order Book Cache Handler.

Hi! I’m here to help you understand CVE-2026-19037. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70