CVE-2025-12979: Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure
The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'uscesexport' action in all versions up to, and including, 2.11.24. This makes it possible for unauthenticated attackers to access configured payment credentials (ex. PayPal api secret) , as well as business contact details, mail templates, and other operational settings tied to the store.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12979?
CVE-2025-12979 is classified as a medium severity vulnerability due to the potential for unauthorized data access.
How do I fix CVE-2025-12979?
To fix CVE-2025-12979, update the Welcart e-Commerce plugin to version 2.11.25 or later.
Who is affected by CVE-2025-12979?
CVE-2025-12979 affects all versions of the Welcart e-Commerce plugin up to and including version 2.11.24.
What type of vulnerability is CVE-2025-12979?
CVE-2025-12979 is a vulnerability that allows unauthorized access to sensitive payment data due to a missing capability check.
Can CVE-2025-12979 be exploited remotely?
Yes, CVE-2025-12979 can be exploited remotely by unauthenticated attackers to access payment information.