CVE-2026-119166 in Welcart e-Commerce Plugin
Summary
by MITRE • 10/31/2026
The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'member[ID]' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existing Welcart shop-member account's email address and password by supplying that member's numeric ID, then authenticate as that member to achieve full account takeover. The only authentication barrier is a wp_verify_nonce() check against a nonce printed to every unauthenticated visitor on the auto-published New Enrollment Form, meaning no existing account, no WordPress login, and no non-default configuration is required to exploit this vulnerability.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/31/2026
The Welcart e-Commerce plugin for WordPress contains a critical security flaw classified as an Insecure Direct Object Reference, specifically affecting versions up through 2.12.5. This vulnerability stems from insufficient validation of user-supplied input within the member ID parameter used during account management operations. The core technical failure lies in the application's inability to verify that the requesting entity has authorization to modify or access the specific resource identified by the provided numeric identifier. Instead of binding actions to authenticated sessions with proper permission checks, the system relies on a nonce-based protection mechanism which proves insufficient against this class of attack.
The operational impact of this vulnerability is severe, allowing unauthenticated attackers to perform full account takeover without any prior authentication or existing credentials. By supplying a valid member ID from an existing shop-member account, an attacker can overwrite both the email address and password associated with that account. This capability effectively grants the attacker complete control over the victim's e-commerce profile, enabling them to access order history, personal data, and potentially initiate fraudulent transactions under the guise of the legitimate user. The absence of a requirement for existing accounts or specific WordPress login configurations makes this vulnerability particularly dangerous as it can be exploited by any internet user with basic technical knowledge.
The exploitation mechanism bypasses traditional authentication barriers through a flawed reliance on wp_verify_nonce() checks against nonces generated in auto-published New Enrollment Forms visible to all unauthenticated visitors. Since these forms are publicly accessible, the necessary cryptographic tokens for initiating account changes are readily available to potential attackers. This design oversight means that even users with default configurations or no prior interaction history can leverage this flaw. The lack of server-side validation ensuring that the actor modifying a record is indeed the owner of that record constitutes a classic IDOR scenario where object-level access controls are missing or incorrectly implemented.
From an industry standards perspective, this vulnerability aligns directly with CWE-284, which describes Improper Access Control involving Insecure Direct Object References. It also maps to MITRE ATT&CK techniques related to Account Manipulation and Credential Access, specifically the ability to modify account properties such as passwords or email addresses to maintain persistence or escalate privileges within the application context. The failure to enforce proper authorization checks on sensitive data modification endpoints represents a significant deviation from secure coding practices recommended by OWASP for web applications handling user credentials and personal information.
Mitigation strategies must prioritize immediate patching of the Welcart plugin to version 2.12.6 or later, where these validation gaps have been addressed. In addition to updating software, administrators should implement strict server-side authorization checks that verify the current session's ownership over any resource being modified. Input validation should be enhanced to ensure that only authorized actions are permitted based on verified user identity rather than relying solely on nonce validity in public-facing forms. Regular security audits and penetration testing focusing on access control mechanisms can help identify similar vulnerabilities before they are exploited in production environments, ensuring the integrity of customer data and account security within the e-commerce platform.