CVE-2025-15671: Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter
The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Welcart e-Commerce WordPress pluginto a version that resolves this vulnerability.Fixed in 2.12.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Welcart e-Commerce WordPress plugin versions earlier than 2.12.1 are affected. The issue concerns shop member authentication flows.
What must an attacker do to exploit this?
An unauthenticated attacker must induce a shop member to log in through an attacker-crafted request containing a chosen uscesid parameter. Because the session identifier is not regenerated on authentication, the attacker can then use the fixated session to take over the customer's account.
Are unauthenticated attackers able to exploit the issue?
Yes. The attacker does not need to authenticate, but successful account takeover depends on a victim logging in through the crafted request.
How can I tell whether I am affected?
Check the installed Welcart e-Commerce plugin version. Versions before 2.12.1 are affected.