# Welcart e-Commerce <= 2.12.6 - Unauthenticated Payment Bypass via Forged ZEUS Secure Link and AnotherLane Payment Notifications

- **ID:** WPSEC-2026-2356
- **Plugin:** Welcart e-Commerce (`usc-e-shop`), https://wordpress.org/plugins/usc-e-shop/
- **Affected versions:** all versions before 2.12.7
- **Fixed in:** 2.12.7 (Update to 2.12.7 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/usc-e-shop
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2356/

## Description

The Welcart e-Commerce plugin for WordPress is vulnerable to Payment Bypass via forged payment notifications in all versions up to, and including, 2.12.6, due to insufficient verification of the source of the request. ZEUS Secure Link card notifications were accepted without checking the source IP address, and AnotherLane card notifications were processed on sites that do not use or configure AnotherLane. This makes it possible for unauthenticated attackers to have orders registered as completed without making a real payment.

## References

- https://wpsec.com/vuln/WPSEC-2026-2356/
- https://plugins.svn.wordpress.org/usc-e-shop/tags/2.12.7/
- https://wordpress.org/plugins/usc-e-shop/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2356/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.