CVE-2026-19887: Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback
The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (uscesactionactingtransaction). Unauthenticated attackers can store arbitrary 'reserve' key/value pairs as order metadata during a public checkout, then invoke the callback with an attacker-chosen 'option' parameter to select and unserialize that metadata without any provider signature, source-address, transaction-identity or ownership check. A POP chain is present in the TCPDF library bundled with the plugin itself, so no additional plugin or theme is required. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, including wp-config.php, which can lead to remote code execution when an attacker re-runs the WordPress installer against a database they control. Successful exploitation is contingent on an admin printing an invoice to trigger file deletion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Welcart e-Commerce pluginto a version that resolves this vulnerability.Fixed in 2.12.1 - Compensating control
Because successful exploitation requires an admin to print an invoice (which triggers file deletion), restrict/limit who can access invoice printing actions in the WordPress admin UI to reduce likelihood of exploitation.
- Compensating control
Restrict access to the Welcart Telecom EDY payment callback endpoint (usces_action_acting_transaction) to trusted parties (e.g., block/allow at the network or web layer) to reduce exposure to unauthenticated PHP object injection attempts.
Event History
Frequently Asked Questions
What conditions are required for exploitation to succeed?
An attacker can act without authentication by submitting a public checkout with crafted reserve metadata and then calling the Telecom EDY callback with a chosen option value. However, arbitrary file deletion is triggered only when an administrator prints an invoice.
Are sites using only this plugin at risk, or is another vulnerable component required?
The required PHP object-oriented programming chain is present in the TCPDF library bundled with Welcart e-Commerce. No additional plugin or theme is required.
What validation is missing from the affected callback?
The callback does not verify a provider signature, source address, transaction identity, or transaction ownership before selecting and unserializing order metadata. This allows an unauthenticated attacker to choose attacker-controlled stored reserve values.
How could file deletion lead to further compromise?
Deletion can include wp-config.php. The described impact is remote code execution if an attacker subsequently reruns the WordPress installer against a database they control.