{
 "id": "WPSEC-2026-2357",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2357/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2357/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2357/index.md",
 "title": "Welcart e-Commerce <= 2.12.6 - Unauthenticated Payment Amount Manipulation via SBPS Token Card Payment",
 "description": "The Welcart e-Commerce plugin for WordPress is vulnerable to payment amount manipulation via the SBPS token card payment request in all versions up to, and including, 2.12.6 due to the payment amount being taken from client-submitted POST data instead of the order data. This makes it possible for unauthenticated customers to tamper with the amount sent to the payment gateway and pay less than the order total on sites using the SBPS token credit card payment method.",
 "plugin": {
  "slug": "usc-e-shop",
  "name": "Welcart e-Commerce",
  "full_name": "Welcart e-Commerce",
  "wordpress_org": "https://wordpress.org/plugins/usc-e-shop/",
  "advisories_url": "https://wpsec.com/vuln/plugin/usc-e-shop/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/usc-e-shop"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-602"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.12.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.12.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.12.7",
 "remediation": "Update to 2.12.7 or later.",
 "fix_released": "2026-11-02T01:19:10+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:39:56.017593+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2357/",
  "https://plugins.svn.wordpress.org/usc-e-shop/tags/2.12.7/",
  "https://wordpress.org/plugins/usc-e-shop/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/usc-e-shop",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}