What is the CVSS score of CVE-2025-15671?

CVE-2025-15671 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2025-15671?

Yes, a public proof-of-concept exploit is available for CVE-2025-15671. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2025-15671?

Yes, a patch is available for CVE-2025-15671. Update the affected software to the latest version immediately.

Welcart e-Commerce CVE-2025-15671

EUVD-2025-210759 MEDIUM

Improper Authentication (CWE-287)

2026-08-21 WPScan

GHSA-5v22-2f7p-c962

WordPress Authentication Bypass Welcart E Commerce Unknown

5.4

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:N because the attacker needs no credentials; UI:R is mandatory as the victim must authenticate via the attacker's crafted request; C:L/I:L reflects customer-account scope only with no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 21, 2026 - 13:23 vuln.today

CVSS changed

Aug 21, 2026 - 13:22 NVD

5.4 (MEDIUM)

Patch available

Aug 21, 2026 - 07:16 EUVD

CVE Published

Aug 21, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 21, 2026 - 06:00 cve.org

MEDIUM 5.4

DescriptionCVE.org

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.

AnalysisAI

Session fixation in the Welcart e-Commerce WordPress plugin (all versions before 2.12.1) allows an unauthenticated remote attacker to pre-set a shop member's session identifier via a user-supplied request parameter, then silently hijack the authenticated session once the victim logs in through an attacker-crafted request. Because the plugin neither generates a fresh session ID on authentication nor rejects externally supplied session tokens, the attacker's chosen token becomes the victim's authenticated session. A publicly available POC exists via WPScan, and no KEV listing is present, though the combination of no required attacker privileges and a low-complexity exploit path elevates practical risk for any live Welcart storefront.

Technical ContextAI

Session fixation is a subclass of CWE-287 (Improper Authentication) in which an application allows a user-controlled value to determine the session identifier, bypassing the expectation that the server exclusively generates session tokens. Proper session management mandates regenerating the session ID at privilege elevation (i.e., login) to sever any attacker-controlled pre-authentication token. Welcart e-Commerce, a Japanese-market WordPress plugin for online shops, violates both properties: it accepts the session identifier from a request parameter and does not rotate it after the customer authenticates. The affected CPE is cpe:2.3:a:unknown:welcart_e-commerce:*:*:*:*:*:*:*:*, covering the full version range from initial release up to but not including 2.12.1. The vulnerability sits in Welcart's own session-handling layer, distinct from WordPress core session management.

RemediationAI

Vendor-released patch: Welcart e-Commerce version 2.12.1. Site administrators should update the plugin immediately via the WordPress admin dashboard or by downloading version 2.12.1 or later. Advisory and patch details are available at https://wpscan.com/vulnerability/3b2d4e7f-1e2a-4712-af9b-50080106d52c/ and https://nvd.nist.gov/vuln/detail/CVE-2025-15671. If immediate patching is not feasible, a compensating control is to deploy a WAF rule that strips or rejects requests containing session identifier parameters in query strings or POST bodies before they reach WordPress - this can break legitimate session flows if Welcart uses them elsewhere, so testing in staging is required. Additionally, temporarily disabling customer account login (forcing guest checkout) eliminates the attack surface at the cost of user experience. Neither workaround fully substitutes for applying version 2.12.1.