CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
Missing Authorization vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Welcart e-Commerce: from n/a through <= 2.11.24.
AnalysisAI
Broken access control in Welcart e-Commerce WordPress plugin through version 2.11.24 allows authenticated users to bypass authorization checks and perform unauthorized actions with elevated privileges. This authentication bypass vulnerability (CWE-862) enables low-privileged authenticated attackers to access, modify, or delete data beyond their permission level, potentially compromising store operations, customer data, and site integrity. EPSS score of 0.05% (15th percentile) suggests low immediate exploitation probability, though no public exploit has been identified at time of analysis.
Technical ContextAI
This vulnerability stems from CWE-862 (Missing Authorization), specifically affecting the Welcart e-Commerce plugin for WordPress (usc-e-shop), a Japanese e-commerce solution. The flaw manifests as incorrectly configured or absent access control checks that fail to verify whether an authenticated user has sufficient permissions before executing sensitive operations. In WordPress plugin architecture, this typically occurs when plugin endpoints or admin AJAX handlers lack proper capability checks (such as current_user_can() validations), allowing any logged-in user to invoke administrative or privileged functions. The vulnerability was reported through Patchstack's audit process, indicating discovery via security research rather than active exploitation. The affected product operates within WordPress's role-based access control system, where the missing authorization checks undermine the intended security boundary between subscriber/customer roles and administrator/shop manager roles.
Affected ProductsAI
The vulnerability affects Welcart e-Commerce plugin for WordPress, specifically the usc-e-shop component, in all versions up to and including 2.11.24. Welcart is a popular Japanese e-commerce solution for WordPress sites, providing shopping cart functionality, payment processing integration, and order management capabilities. The affected version range begins from an unspecified early version (listed as 'n/a' in vulnerability data) through the confirmed vulnerable version 2.11.24. Organizations running WordPress installations with the usc-e-shop plugin at version 2.11.24 or earlier should consider themselves affected. The vulnerability was documented by Patchstack with detailed information available at their advisory database entry for this specific plugin and version range.
RemediationAI
Organizations running affected Welcart e-Commerce installations should immediately check their current plugin version via the WordPress admin dashboard under Plugins section. Upgrade to a patched version of the usc-e-shop plugin newer than 2.11.24 as soon as the vendor releases an update addressing this CVE. Monitor the official Welcart WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/usc-e-shop/vulnerability/wordpress-welcart-e-commerce-plugin-2-11-24-broken-access-control-vulnerability for patch availability and release announcements. Upstream fix available (PR/commit); released patched version not independently confirmed from available data at time of analysis. As interim mitigation while awaiting patches, implement defense-in-depth measures including restricting user registration to prevent arbitrary attackers from obtaining the low-privileged authentication required for exploitation, reviewing existing user accounts for suspicious low-privilege accounts that may have been created for exploitation purposes, implementing web application firewall rules to monitor for unusual API or admin-ajax.php requests from non-administrative users, and enabling comprehensive WordPress audit logging to detect potential exploitation attempts. Organizations unable to patch immediately should consider temporarily disabling the plugin if e-commerce functionality can be suspended, or restricting site access to trusted users only until remediation is completed.
Share
External POC / Exploit Code
Leaving vuln.today