Vulnerabilities / Welcart e-Commerce / WPSEC-2026-2357
Welcart e-Commerce <= 2.12.6 - Unauthenticated Payment Amount Manipulation via SBPS Token Card Payment
Medium 5.3
CWE-602Fixed in 2.12.7
- ID
- WPSEC-2026-2357
- Plugin
- Welcart e-Commerce (usc-e-shop)
- Affected
- all versions before 2.12.7
- Remediation
- Update to 2.12.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-602
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- Welcart e-Commerce on WPSec AttackSurface
- Fix released
- Published
Description
The Welcart e-Commerce plugin for WordPress is vulnerable to payment amount manipulation via the SBPS token card payment request in all versions up to, and including, 2.12.6 due to the payment amount being taken from client-submitted POST data instead of the order data. This makes it possible for unauthenticated customers to tamper with the amount sent to the payment gateway and pay less than the order total on sites using the SBPS token credit card payment method.
References
- https://wpsec.com/vuln/WPSEC-2026-2357/
- https://plugins.svn.wordpress.org/usc-e-shop/tags/2.12.7/
- https://wordpress.org/plugins/usc-e-shop/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS