# Welcart e-Commerce <= 2.12.5 - Authenticated (Author+) Missing Authorization to Item SKU, Option and Image Modification

- **ID:** WPSEC-2026-1572
- **Plugin:** Welcart e-Commerce (`usc-e-shop`), https://wordpress.org/plugins/usc-e-shop/
- **Affected versions:** all versions before 2.12.6
- **Fixed in:** 2.12.6 (Update to 2.12.6 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/usc-e-shop
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1572/

## Description

The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized modification of data due to missing object-level capability checks in the item edit screen's AJAX handlers for item options, SKUs and item images in all versions up to, and including, 2.12.5. The handlers checked only a generic capability, not whether the user could edit the targeted item or attachment, and SKU and option rows were updated or deleted by meta ID without checking which item they belonged to. This makes it possible for authenticated attackers with author-level access and above to modify or delete the SKUs and options of items belonging to other users, delete attachments they do not own, and change the alt text or caption (excerpt) of posts they cannot edit.

## References

- https://wpsec.com/vuln/WPSEC-2026-1572/
- https://plugins.svn.wordpress.org/usc-e-shop/tags/2.12.6/
- https://wordpress.org/plugins/usc-e-shop/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1572/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.