# Welcart e-Commerce <= 2.12.5 - Authenticated (Author+) Sensitive Information Exposure via Item CSV Export

- **ID:** WPSEC-2026-1573
- **Plugin:** Welcart e-Commerce (`usc-e-shop`), https://wordpress.org/plugins/usc-e-shop/
- **Affected versions:** all versions before 2.12.6
- **Fixed in:** 2.12.6 (Update to 2.12.6 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/usc-e-shop
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1573/

## Description

The Welcart e-Commerce plugin for WordPress is vulnerable to Sensitive Information Exposure via the item CSV export and the item master list in all versions up to, and including, 2.12.5, due to the export and list queries not excluding private items of other users and the export always including each item's post password. This makes it possible for authenticated attackers with author-level access and above to read private items and the passwords of password-protected items that belong to other users.

## References

- https://wpsec.com/vuln/WPSEC-2026-1573/
- https://plugins.svn.wordpress.org/usc-e-shop/tags/2.12.6/
- https://wordpress.org/plugins/usc-e-shop/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1573/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.