CVE-2025-15671
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.
Risk Assessment
An attacker can take over a customer account, potentially leading to personal data theft, unauthorized transactions, or loss of customer trust.
Recommendation
Update the Welcart e-Commerce plugin to version 2.12.1 or later, which includes the session regeneration fix. Additionally, consider implementing additional session protection mechanisms.
Other vulnerabilities in Welcart e-Commerce
See all- CVE-2026-27539High
Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce versions up to 2.11.31. An attacker can inject malicious script without authentication.
- CVE-2026-15213Medium
The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying.
- CVE-2026-16066Medium
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.
- CVE-2026-49775Medium
Welcart e-Commerce versions up to 2.11.28 have an issue with unauthenticated access that can lead to broken access control.
Original NVD description (English source)
The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.