Welcart e-Commerce <= 2.12.5 - Unauthenticated Shop Member Account Takeover via Member Update
- ID
- WPSEC-2026-1570
- Plugin
- Welcart e-Commerce (usc-e-shop)
- Affected
- all versions before 2.12.6
- Remediation
- Update to 2.12.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weakness
- CWE-915
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-23
- Attack surface
- Welcart e-Commerce on WPSec AttackSurface
- Fix released
- Published
Description
The Welcart e-Commerce plugin for WordPress is vulnerable to account takeover via the shop member update feature (editmember / regmember with member_regmode 'editmemberform') in all versions up to, and including, 2.12.5, due to member_check() copying every submitted 'member' field, including 'ID', into the session member data before the target member is determined, and due to a missing login check in the editmember handler. The update query then uses this session ID as the member to update. This makes it possible for unauthenticated attackers, who can get the session-bound member nonce from the public login or registration form, to change the e-mail address and password of any shop member by supplying that member's ID, and then log in as that member.
References
- https://wpsec.com/vuln/WPSEC-2026-1570/
- https://plugins.svn.wordpress.org/usc-e-shop/tags/2.12.6/
- https://wordpress.org/plugins/usc-e-shop/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS