The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'member[ID]' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existing Welcart shop-member account's email address and password by supplying that member's numeric ID, then authenticate as that member to achieve full account takeover. The only authentication barrier is a wp_verify_nonce() check against a nonce printed to every unauthenticated visitor on the auto-published New Enrollment Form, meaning no existing account, no WordPress login, and no non-default configuration is required to exploit this vulnerability.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 5.3 · uscnanbuNVD modified 2026-10-31 06:44
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e93b0ebf-576d-48d0-95f7-87135f45980f?source=cve
- https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/classes/usceshop.class.php#L4470
- https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/classes/usceshop.class.php#L5509
- https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/classes/usceshop.class.php#L5070
- https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/classes/usceshop.class.php#L3848
- https://plugins.trac.wordpress.org/changeset/3760784/usc-e-shop
- https://plugins.trac.wordpress.org/changeset/3760784/usc-e-shop/trunk/classes/usceshop.class.php