Welcart e-Commerce <= 2.12.5 - Authenticated (Author+) Missing Authorization to Item SKU, Option and Image Modification
- ID
- WPSEC-2026-1572
- Plugin
- Welcart e-Commerce (usc-e-shop)
- Affected
- all versions before 2.12.6
- Remediation
- Update to 2.12.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-23
- Attack surface
- Welcart e-Commerce on WPSec AttackSurface
- Fix released
- Published
Description
The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized modification of data due to missing object-level capability checks in the item edit screen's AJAX handlers for item options, SKUs and item images in all versions up to, and including, 2.12.5. The handlers checked only a generic capability, not whether the user could edit the targeted item or attachment, and SKU and option rows were updated or deleted by meta ID without checking which item they belonged to. This makes it possible for authenticated attackers with author-level access and above to modify or delete the SKUs and options of items belonging to other users, delete attachments they do not own, and change the alt text or caption (excerpt) of posts they cannot edit.
References
- https://wpsec.com/vuln/WPSEC-2026-1572/
- https://plugins.svn.wordpress.org/usc-e-shop/tags/2.12.6/
- https://wordpress.org/plugins/usc-e-shop/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS