# Welcart e-Commerce <= 2.12.6 - Unauthenticated Payment Amount Manipulation via SBPS Token Card Payment

- **ID:** WPSEC-2026-2357
- **Plugin:** Welcart e-Commerce (`usc-e-shop`), https://wordpress.org/plugins/usc-e-shop/
- **Affected versions:** all versions before 2.12.7
- **Fixed in:** 2.12.7 (Update to 2.12.7 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-602
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/usc-e-shop
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2357/

## Description

The Welcart e-Commerce plugin for WordPress is vulnerable to payment amount manipulation via the SBPS token card payment request in all versions up to, and including, 2.12.6 due to the payment amount being taken from client-submitted POST data instead of the order data. This makes it possible for unauthenticated customers to tamper with the amount sent to the payment gateway and pay less than the order total on sites using the SBPS token credit card payment method.

## References

- https://wpsec.com/vuln/WPSEC-2026-2357/
- https://plugins.svn.wordpress.org/usc-e-shop/tags/2.12.7/
- https://wordpress.org/plugins/usc-e-shop/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2357/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.