CVE-2026-19213
Received Received - Intake

Remote Code Execution in WonderTrader

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: VulDB

Description
A vulnerability was identified in WonderTrader up to 0.9.9. Affected is the function _undone_qty in the library src/WtCore/TraderAdapter.h of the component Pending Order Handler. The manipulation of the argument getUndoneQty leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-19213
EUVD
EUVD-2026-54559

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wondertrader wondertrader to 0.9.9 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-840 Business Logic Errors
CWE-841 The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in WonderTrader versions up to 0.9.9, specifically in the Pending Order Handler component. The issue is in the function _undone_qty within src/WtCore/TraderAdapter.h. An attacker can manipulate the getUndoneQty argument to alter the system's behavior, potentially leading to unauthorized actions.

Impact Analysis

The vulnerability allows remote attackers to enforce behavioral changes in the system. Since the exploit is publicly available, it increases the risk of unauthorized access or manipulation of pending orders. The impact is limited by the need for a low privilege level (PR:L).

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves behavioral workflow manipulation in a trading system rather than data privacy or security controls.

Mitigation Strategies

Upgrade WonderTrader to a version beyond 0.9.9 if available. Monitor network traffic for unusual activity related to order handling. Restrict access to the Pending Order Handler component to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19213. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart