Welcart e-Commerce Plugin up to 2.12.1 on WordPress Telecom EDY Payment Callback usces_action_acting_transaction option deserialization

Summaryinfo

A vulnerability identified as critical has been detected in Welcart e-Commerce Plugin up to 2.12.1. This affects the function usces_action_acting_transaction of the component Telecom EDY Payment Callback. This manipulation of the argument option causes deserialization. This vulnerability is tracked as CVE-2026-19887. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Welcart e-Commerce Plugin up to 2.12.1. It has been declared as critical. Affected by this vulnerability is the function usces_action_acting_transaction of the component Telecom EDY Payment Callback. The manipulation of the argument option with an unknown input leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary 'reserve' key/value pairs as order metadata during a public checkout, then invoke the callback with an attacker-chosen 'option' parameter to select and unserialize that metadata without any provider signature, source-address, transaction-identity or ownership check. A POP chain is present in the TCPDF library bundled with the plugin itself, so no additional plugin or theme is required. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, including wp-config.php, which can lead to remote code execution when an attacker re-runs the WordPress installer against a database they control. Successful exploitation is contingent on an admin printing an invoice to trigger file deletion.

It is possible to read the advisory at wordfence.com. This vulnerability is known as CVE-2026-19887 since 08/14/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/05/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-71883). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• Welcart e-Commerce Plugin

Version

• 2.12.0
• 2.12.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion