Vulnerabilities / Welcart e-Commerce / WPSEC-2026-0932
Welcart e-Commerce <= 2.12.4 - Unauthenticated Payment Bypass via Forged Digitalcheck Card Payment Notification
Medium 5.3
CWE-290Fixed in 2.12.5
- ID
- WPSEC-2026-0932
- Plugin
- Welcart e-Commerce (usc-e-shop)
- Affected
- all versions before 2.12.5
- Remediation
- Update to 2.12.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-290
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-14
- Attack surface
- Welcart e-Commerce on WPSec AttackSurface
- Fix released
- Published
Description
The Welcart e-Commerce plugin for WordPress is vulnerable to authentication bypass by spoofing via the Payment For (Digitalcheck) card payment notification in all versions up to, and including, 2.12.4, due to the server-to-server notification being processed without checking that it comes from the payment provider's IP addresses. This makes it possible for unauthenticated attackers to send forged card payment notifications that register their pending orders as completed without paying, on sites that use Digitalcheck card payments.
References
- https://wpsec.com/vuln/WPSEC-2026-0932/
- https://plugins.svn.wordpress.org/usc-e-shop/tags/2.12.5/
- https://wordpress.org/plugins/usc-e-shop/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS