Vulnerabilities / Welcart e-Commerce / WPSEC-2026-0931
Welcart e-Commerce <= 2.12.4 - Unauthenticated Payment Amount Manipulation via 'money' Parameter
Medium 5.3
CWE-472Fixed in 2.12.5
- ID
- WPSEC-2026-0931
- Plugin
- Welcart e-Commerce (usc-e-shop)
- Affected
- all versions before 2.12.5
- Remediation
- Update to 2.12.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-472
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-14
- Attack surface
- Welcart e-Commerce on WPSec AttackSurface
- Fix released
- Published
Description
The Welcart e-Commerce plugin for WordPress is vulnerable to payment amount manipulation via the 'money' parameter of the ZEUS payment integration (Secure Link card, convenience store, BNPL and Secure API card payment requests) in all versions up to, and including, 2.12.4, due to the amount sent to the payment gateway being taken from the client-supplied request instead of the order total stored in the session. This makes it possible for unauthenticated shoppers to pay a lower amount than the order total on sites that use the ZEUS payment gateway.
References
- https://wpsec.com/vuln/WPSEC-2026-0931/
- https://plugins.svn.wordpress.org/usc-e-shop/tags/2.12.5/
- https://wordpress.org/plugins/usc-e-shop/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS