EUVD-2026-57172
GHSA-6p56-v4j4-jm3x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible callback accepts unauthenticated requests with no complexity; impact is strictly limited to order payment status integrity with no confidentiality or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying.
AnalysisAI
Payment callback fraud in the Welcart e-Commerce WordPress plugin (versions before 2.11.33) allows any unauthenticated remote attacker to flip their own unpaid order to a settled/paid state by submitting a crafted HTTP request containing only an order number and a status flag - no signature, payment amount, or origin IP is validated. Merchants offering convenience-store or bank-transfer pay-later methods are directly exposed to financial fraud, enabling attackers to obtain goods or services without transferring funds. A publicly available proof-of-concept exists; no active exploitation has been confirmed by CISA KEV at time of analysis.
Technical ContextAI
Welcart e-Commerce is a WordPress plugin for Japanese-market e-commerce that supports pay-later settlement workflows, including convenience-store (combini) payment and bank-transfer methods. In these workflows, an external payment processor is expected to POST a callback to the merchant's site once the customer completes payment offline. The plugin's handler for these callbacks fails to implement any authenticity control - it accepts the status update from any source without a shared HMAC secret, API key, IP allowlist, or amount reconciliation check. This maps conceptually to CWE-345 (Insufficient Verification of Data Authenticity) and CWE-306 (Missing Authentication for Critical Function), though no formal CWE is assigned in the advisory. Affected CPE is cpe:2.3:a:unknown:welcart_e-commerce:*:*:*:*:*:*:*:* covering all releases prior to 2.11.33. The vendor name field in the CPE is listed as 'unknown', which reduces reliability of automated CPE-based scanner matching.
RemediationAI
Upgrade Welcart e-Commerce to version 2.11.33 or later, which introduces proper callback authenticity verification for convenience-store and bank-transfer settlement endpoints. The fix is documented at https://wpscan.com/vulnerability/4ca89701-8abc-4ecb-9834-a648ab1c4da1/. For merchants unable to patch immediately, the most effective interim control is to disable convenience-store and bank-transfer payment methods entirely via the plugin settings - this removes the vulnerable callback surface at the cost of losing those payment options for customers. Alternatively, configure a web server or WAF rule to restrict access to the settlement callback URL to the IP ranges published by your specific payment gateway partner, bearing in mind this approach requires accurate and maintained IP allowlists and may break if the processor changes IP ranges. Do not rely on obscurity of the callback URL endpoint as a control, as order numbers are typically sequential or guessable.
More in Welcart E Commerce
View allThe Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtnia
Unauth. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low
The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have au
The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usc
Stored cross-site scripting in the Welcart e-Commerce WordPress plugin (all versions before 2.11.34) allows any authenti
The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on th
SQL injection in the Welcart e-Commerce WordPress plugin (all versions before 2.11.32) enables authenticated users holdi
The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing an
The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back
Session fixation in the Welcart e-Commerce WordPress plugin (all versions before 2.12.1) allows an unauthenticated remot
The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any
Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. Rated high seve
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today