What is the CVSS score of EUVD-2026-36895?

EUVD-2026-36895 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Welcart e-Commerce EUVD-2026-36895

| CVE-2026-49775 MEDIUM

Missing Authorization (CWE-862)

2026-06-15 Patchstack

GHSA-vh2q-m85w-97h5

Authentication Bypass Welcart E Commerce

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable with no auth or interaction required; no confidentiality impact; low integrity and availability impact align with missing-authorization scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:50 vuln.today

CVE Published

Jun 15, 2026 - 20:19 cve.org

MEDIUM 6.5

DescriptionCVE.org

Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.

AnalysisAI

Unauthenticated broken access control in the Welcart e-Commerce WordPress plugin (versions up to and including 2.11.28) permits remote attackers without any credentials to bypass authorization checks and perform restricted actions. Rooted in CWE-862 (Missing Authorization), the flaw exposes low-severity but tangible integrity and availability impacts against any WordPress installation running the affected plugin. No public exploit code has been identified at the time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Welcart e-Commerce is a WordPress e-commerce plugin identified by CPE cpe:2.3:a:info@welcart:welcart_e-commerce:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization), a class of flaw in which the application processes a request without verifying that the initiating user holds the required permission level for that operation. In a WordPress context this typically manifests as AJAX handlers, REST API endpoints, or admin-facing actions registered without proper capability checks (e.g., missing check_ajax_referer, current_user_can, or equivalent nonce/permission gates), allowing any HTTP client - authenticated or not - to invoke privileged functionality. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the endpoint is reachable over the network with no authentication and no user interaction required.

RemediationAI

The primary remediation is to update the Welcart e-Commerce plugin to a version above 2.11.28 via the WordPress admin dashboard or WP-CLI (wp plugin update usc-e-shop). No exact fixed release version is independently confirmed from the available data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/usc-e-shop/vulnerability/wordpress-welcart-e-commerce-plugin-2-11-28-broken-access-control-vulnerability and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-49775 for the latest confirmed fix version before upgrading. As a compensating control where immediate upgrade is not feasible, restrict access to the WordPress admin AJAX endpoint (/wp-admin/admin-ajax.php) and any REST API routes registered by the plugin to authenticated or allowlisted IP ranges via web server rules or a WAF; note this may break legitimate storefront functionality and requires testing. Enabling a WordPress security plugin (e.g., Wordfence, Patchstack Shield) with virtual patching for this CVE can provide interim protection without disrupting the site.