{
 "id": "WPSEC-2026-1572",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1572/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1572/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1572/index.md",
 "title": "Welcart e-Commerce <= 2.12.5 - Authenticated (Author+) Missing Authorization to Item SKU, Option and Image Modification",
 "description": "The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized modification of data due to missing object-level capability checks in the item edit screen's AJAX handlers for item options, SKUs and item images in all versions up to, and including, 2.12.5. The handlers checked only a generic capability, not whether the user could edit the targeted item or attachment, and SKU and option rows were updated or deleted by meta ID without checking which item they belonged to. This makes it possible for authenticated attackers with author-level access and above to modify or delete the SKUs and options of items belonging to other users, delete attachments they do not own, and change the alt text or caption (excerpt) of posts they cannot edit.",
 "plugin": {
  "slug": "usc-e-shop",
  "name": "Welcart e-Commerce",
  "full_name": "Welcart e-Commerce",
  "wordpress_org": "https://wordpress.org/plugins/usc-e-shop/",
  "advisories_url": "https://wpsec.com/vuln/plugin/usc-e-shop/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/usc-e-shop"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.12.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.12.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.12.6",
 "remediation": "Update to 2.12.6 or later.",
 "fix_released": "2026-10-23T02:01:40+00:00",
 "published": "2026-10-24T02:41:06+00:00",
 "updated": "2026-10-23T07:09:32.081071+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1572/",
  "https://plugins.svn.wordpress.org/usc-e-shop/tags/2.12.6/",
  "https://wordpress.org/plugins/usc-e-shop/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/usc-e-shop",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-23"
 }
}