# Welcart e-Commerce <= 2.12.4 - Unauthenticated Payment Amount Manipulation via 'money' Parameter

- **ID:** WPSEC-2026-0931
- **Plugin:** Welcart e-Commerce (`usc-e-shop`), https://wordpress.org/plugins/usc-e-shop/
- **Affected versions:** all versions before 2.12.5
- **Fixed in:** 2.12.5 (Update to 2.12.5 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-472
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/usc-e-shop
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0931/

## Description

The Welcart e-Commerce plugin for WordPress is vulnerable to payment amount manipulation via the 'money' parameter of the ZEUS payment integration (Secure Link card, convenience store, BNPL and Secure API card payment requests) in all versions up to, and including, 2.12.4, due to the amount sent to the payment gateway being taken from the client-supplied request instead of the order total stored in the session. This makes it possible for unauthenticated shoppers to pay a lower amount than the order total on sites that use the ZEUS payment gateway.

## References

- https://wpsec.com/vuln/WPSEC-2026-0931/
- https://plugins.svn.wordpress.org/usc-e-shop/tags/2.12.5/
- https://wordpress.org/plugins/usc-e-shop/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0931/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.