Welcart e-Commerce, CVE-2025-15671

CVE, Research URL: CVE-2025-15671
Home page URL: Security reports for Welcart e-Commerce
Application: Welcart e-Commerce
Published on: Aug 21, 2026
Research Description: The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.
Affected versions: max 2.12.1.
Status: vulnerable