Welcart e-Commerce EUVD-2026-114615

Exploitable against default installations: the plugin auto-publishes the New Enrollment Form, which prints the wp_verify_nonce() nonce to every unauthenticated visitor, so the attacker simply reads that nonce from the public page and then POSTs the 'member[ID]' parameter set to a victim's numeric member ID together with a new email and password. No existing account, no WordPress login, and no non-default configuration are required. The practical limiting factors are: the attacker must supply a currently-valid nonce harvested from the public form, and must know or enumerate the target's numeric member ID (likely sequential and guessable). It affects all versions up to and including 2.12.5; sites on a later patched build are not exploitable.

The official CVSS of 5.3 (Medium) materially understates the real-world risk, and the disagreement should be resolved in favor of the mechanism described. The provided vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N rates only a low integrity impact with no confidentiality or availability loss, yet the description is explicit that an unauthenticated attacker can overwrite any shop-member's email and password and then authenticate as that member - i.e. full account takeover, which realistically carries high confidentiality, integrity, and availability impact for the victim account. All exploitation signals point the same way: attack vector is network (AV:N), complexity is low (AC:L), no privileges (PR:N) and no user interaction (UI:N), and the only barrier is a wp_verify_nonce() check against a nonce that is printed to every unauthenticated visitor on the auto-published New Enrollment Form, so the barrier is effectively cosmetic. No EPSS score was provided, the CVE is not listed in CISA KEV, and no confirmed public exploit code was supplied, so there is no evidence of active exploitation; the vuln.today decision label is 'this_month' (prioritize, not emergency). Net assessment: this is a genuine priority for any site running the plugin because exploitation is trivial and unauthenticated, even though the raw CVSS score and the absence of KEV/EPSS data would otherwise make it look like a mid-tier issue. The gap between the scored impact (I:L only) and the described account-takeover outcome should be verified against the Wordfence advisory.

An unauthenticated attacker loads the plugin's public New Enrollment Form, copies the nonce that the plugin prints there for any visitor, and submits a request setting the 'member[ID]' parameter to a target member's numeric ID along with an attacker-controlled email and password. The plugin fails to validate that the submitter owns that ID, so the victim account's credentials are overwritten and the attacker logs in as that member for full account takeover. No public exploit code was supplied with this report, though the Wordfence advisory and the patched source lines are referenced.