Welcart e-Commerce CVE-2026-111031

Exploitation requires that an attacker lure a victim into clicking a crafted link to the plugin's redirect functionality, which fails to validate the user-supplied URL before issuing the redirect (per the description); the attacker needs no account or authentication (PR:N). The key limiting factor is mandatory user interaction (UI:R) - the victim must click the malicious link - so this cannot be exploited silently or at scale against a server directly. It affects Welcart e-Commerce versions before 2.12.6; sites on 2.12.6 or later are not affected. The specific vulnerable endpoint and parameter name are not described in the available sources.

This is a moderate-severity open redirect (CWE-601) with CVSS 4.7 and a CVSS:3.1 vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - network-reachable, low complexity, no privileges required (PR:N, so unauthenticated per the vector), but requiring user interaction (UI:R) and yielding only low confidentiality impact with no integrity or availability impact. The signals are internally consistent and point to low real-world urgency: EPSS is 0.17% (6th percentile), there is no CISA KEV listing, and the vuln.today decision label is 'this_month' (routine patching, not act_now/emergency). No confirmed active exploitation and no verified working exploit code are present in the input. This is a classic high-reachability / low-impact issue: easy to trigger in principle but limited to redirecting a victim who clicks an attacker-supplied link, so it is a phishing/social-engineering enabler rather than a direct compromise. Treat it as a genuine but low-priority fix - patch in the normal maintenance cycle. One caveat: the scope-change (S:C) and C:L rating reflect that the redirect can carry a victim to an attacker-controlled site; the plugin itself is not directly breached.

An attacker crafts a URL pointing at the vulnerable Welcart redirect endpoint with an attacker-controlled destination as the unvalidated URL parameter, then distributes it via email or a malicious page. A victim who trusts the legitimate store domain clicks the link and is silently forwarded to an attacker-controlled phishing or malware site, where their trust in the original domain is abused to harvest credentials. No authentication is needed to craft the link, but the attack fails unless the victim actually clicks it (UI:R).