Welcart e-Commerce CVE-2025-15671

The Welcart e-Commerce plugin must be installed and active on a WordPress site running any version prior to 2.12.1. The targeted site must have active customer accounts - exploitation targets registered shop members, not anonymous visitors or WordPress administrators. Exploitation requires victim interaction (UI:R): the shop member must authenticate via an attacker-crafted request that carries the attacker's chosen session token, making social engineering (phishing, malicious link) a prerequisite. The attacker requires no credentials (PR:N). Exploitation is bounded by: (1) the victim must actively log in through the attacker's link rather than a bookmarked or direct URL; (2) the vulnerability affects customer-level accounts, not WordPress admin accounts, limiting post-exploitation scope to the customer's data and shopping capabilities; (3) the attack window closes once the victim logs out or their session expires.

The NVD CVSS 3.1 score of 5.4 Medium is grounded in a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. The PR:N and AC:L metrics confirm low barrier to exploit - no attacker credentials or complex preconditions are required. However, UI:R is the critical limiting factor: the victim must actively use the attacker-crafted request to log in, making this socially engineered rather than fully opportunistic. The C:L/I:L impact reflects customer-account-level access - potentially exposing PII, order history, and enabling unauthorized purchases - rather than administrative compromise. No CISA KEV listing is present, meaning confirmed active exploitation is unverified at time of analysis. A publicly available POC exists via WPScan, significantly lowering the barrier for less sophisticated actors. EPSS data was not provided in source intelligence; defenders should weigh the public POC against the UI:R constraint when prioritizing patching. The real-world risk is moderate for e-commerce operators: customer account takeover can trigger fraud, data exposure liability, and regulatory consequences even without full site compromise.

An attacker generates a known session token value, then embeds it in a crafted login URL or form submission targeting a Welcart-powered shop and delivers it to a customer via phishing email or malicious link. When the victim follows the link and authenticates normally, Welcart binds their authenticated session to the attacker's pre-set token without regeneration. The attacker, who already holds the token, immediately gains full access to the victim's customer account. A publicly available POC via WPScan confirms this attack path is documented and reproducible.