Vulnerabilities / Welcart e-Commerce / WPSEC-2026-2356
Welcart e-Commerce <= 2.12.6 - Unauthenticated Payment Bypass via Forged ZEUS Secure Link and AnotherLane Payment Notifications
Medium 5.3
CWE-345Fixed in 2.12.7
- ID
- WPSEC-2026-2356
- Plugin
- Welcart e-Commerce (usc-e-shop)
- Affected
- all versions before 2.12.7
- Remediation
- Update to 2.12.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- Welcart e-Commerce on WPSec AttackSurface
- Fix released
- Published
Description
The Welcart e-Commerce plugin for WordPress is vulnerable to Payment Bypass via forged payment notifications in all versions up to, and including, 2.12.6, due to insufficient verification of the source of the request. ZEUS Secure Link card notifications were accepted without checking the source IP address, and AnotherLane card notifications were processed on sites that do not use or configure AnotherLane. This makes it possible for unauthenticated attackers to have orders registered as completed without making a real payment.
References
- https://wpsec.com/vuln/WPSEC-2026-2356/
- https://plugins.svn.wordpress.org/usc-e-shop/tags/2.12.7/
- https://wordpress.org/plugins/usc-e-shop/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS