CVE-2026-111031: Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' Parameter

Q: Who can exploit this issue?

An unauthenticated attacker can exploit it; no login or WordPress account is required. The attacker would need to get a user to follow a crafted link that supplies an external URL in the usces_referer parameter.

Q: Which installations are affected?

Welcart e-Commerce versions before 2.12.6 are affected. The provided information does not identify any configuration prerequisite, so affected versions should be treated as exposed if the vulnerable redirect behavior is reachable.

Q: What should be done if an immediate update is not possible?

The provided data does not specify a workaround. Until upgrading to 2.12.6 or later, avoid trusting links containing the usces_referer parameter and warn users about unexpected redirects to external sites.

Published Oct 28, 2026

Updated

The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect users to arbitrary external websites.

Affected Software

1 affected component

Welcart Welcart e-Commerce<2.12.6

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker can exploit it; no login or WordPress account is required. The attacker would need to get a user to follow a crafted link that supplies an external URL in the usces_referer parameter.

Which installations are affected?

Welcart e-Commerce versions before 2.12.6 are affected. The provided information does not identify any configuration prerequisite, so affected versions should be treated as exposed if the vulnerable redirect behavior is reachable.

What should be done if an immediate update is not possible?

The provided data does not specify a workaround. Until upgrading to 2.12.6 or later, avoid trusting links containing the usces_referer parameter and warn users about unexpected redirects to external sites.

CVE-2026-111031: Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' Parameter

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which installations are affected?

What should be done if an immediate update is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which installations are affected?

What should be done if an immediate update is not possible?