# Welcart e-Commerce <= 2.12.5 - Unauthenticated Shop Member Account Takeover via Member Update

- **ID:** WPSEC-2026-1570
- **Plugin:** Welcart e-Commerce (`usc-e-shop`), https://wordpress.org/plugins/usc-e-shop/
- **Affected versions:** all versions before 2.12.6
- **Fixed in:** 2.12.6 (Update to 2.12.6 or later.)
- **Severity:** Critical 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
- **Weakness:** CWE-915
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/usc-e-shop
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1570/

## Description

The Welcart e-Commerce plugin for WordPress is vulnerable to account takeover via the shop member update feature (editmember / regmember with member_regmode 'editmemberform') in all versions up to, and including, 2.12.5, due to member_check() copying every submitted 'member' field, including 'ID', into the session member data before the target member is determined, and due to a missing login check in the editmember handler. The update query then uses this session ID as the member to update. This makes it possible for unauthenticated attackers, who can get the session-bound member nonce from the public login or registration form, to change the e-mail address and password of any shop member by supplying that member's ID, and then log in as that member.

## References

- https://wpsec.com/vuln/WPSEC-2026-1570/
- https://plugins.svn.wordpress.org/usc-e-shop/tags/2.12.6/
- https://wordpress.org/plugins/usc-e-shop/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1570/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.