{
 "id": "WPSEC-2026-1573",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1573/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1573/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1573/index.md",
 "title": "Welcart e-Commerce <= 2.12.5 - Authenticated (Author+) Sensitive Information Exposure via Item CSV Export",
 "description": "The Welcart e-Commerce plugin for WordPress is vulnerable to Sensitive Information Exposure via the item CSV export and the item master list in all versions up to, and including, 2.12.5, due to the export and list queries not excluding private items of other users and the export always including each item's post password. This makes it possible for authenticated attackers with author-level access and above to read private items and the passwords of password-protected items that belong to other users.",
 "plugin": {
  "slug": "usc-e-shop",
  "name": "Welcart e-Commerce",
  "full_name": "Welcart e-Commerce",
  "wordpress_org": "https://wordpress.org/plugins/usc-e-shop/",
  "advisories_url": "https://wpsec.com/vuln/plugin/usc-e-shop/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/usc-e-shop"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.12.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.12.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.12.6",
 "remediation": "Update to 2.12.6 or later.",
 "fix_released": "2026-10-23T02:01:40+00:00",
 "published": "2026-10-24T02:41:06+00:00",
 "updated": "2026-10-23T07:09:32.081071+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1573/",
  "https://plugins.svn.wordpress.org/usc-e-shop/tags/2.12.6/",
  "https://wordpress.org/plugins/usc-e-shop/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/usc-e-shop",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-23"
 }
}