{
 "id": "WPSEC-2026-2356",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2356/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2356/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2356/index.md",
 "title": "Welcart e-Commerce <= 2.12.6 - Unauthenticated Payment Bypass via Forged ZEUS Secure Link and AnotherLane Payment Notifications",
 "description": "The Welcart e-Commerce plugin for WordPress is vulnerable to Payment Bypass via forged payment notifications in all versions up to, and including, 2.12.6, due to insufficient verification of the source of the request. ZEUS Secure Link card notifications were accepted without checking the source IP address, and AnotherLane card notifications were processed on sites that do not use or configure AnotherLane. This makes it possible for unauthenticated attackers to have orders registered as completed without making a real payment.",
 "plugin": {
  "slug": "usc-e-shop",
  "name": "Welcart e-Commerce",
  "full_name": "Welcart e-Commerce",
  "wordpress_org": "https://wordpress.org/plugins/usc-e-shop/",
  "advisories_url": "https://wpsec.com/vuln/plugin/usc-e-shop/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/usc-e-shop"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.12.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.12.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.12.7",
 "remediation": "Update to 2.12.7 or later.",
 "fix_released": "2026-11-02T01:19:10+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:39:56.017593+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2356/",
  "https://plugins.svn.wordpress.org/usc-e-shop/tags/2.12.7/",
  "https://wordpress.org/plugins/usc-e-shop/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/usc-e-shop",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}