# Welcart e-Commerce <= 2.12.4 - Unauthenticated Payment Bypass via Forged Digitalcheck Card Payment Notification

- **ID:** WPSEC-2026-0932
- **Plugin:** Welcart e-Commerce (`usc-e-shop`), https://wordpress.org/plugins/usc-e-shop/
- **Affected versions:** all versions before 2.12.5
- **Fixed in:** 2.12.5 (Update to 2.12.5 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-290
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/usc-e-shop
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0932/

## Description

The Welcart e-Commerce plugin for WordPress is vulnerable to authentication bypass by spoofing via the Payment For (Digitalcheck) card payment notification in all versions up to, and including, 2.12.4, due to the server-to-server notification being processed without checking that it comes from the payment provider's IP addresses. This makes it possible for unauthenticated attackers to send forged card payment notifications that register their pending orders as completed without paying, on sites that use Digitalcheck card payments.

## References

- https://wpsec.com/vuln/WPSEC-2026-0932/
- https://plugins.svn.wordpress.org/usc-e-shop/tags/2.12.5/
- https://wordpress.org/plugins/usc-e-shop/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0932/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.