CVE-2026-119166

Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter

2026-10-30 17:51
R3D

Strategic Overview

Status
Patched in 2.12.6
Affected Plugin
Welcart e-Commerce
Affected Version
<= 2.12.5
CVSS
5.3Medium
Weakness type
CWE-287 · Improper Authentication
CVE
CVE-2026-119166
View all Welcart e-Commerce vulnerabilities

At a glance

CVE-2026-119166 is a medium-severity Improper Authentication vulnerability in the Welcart e-Commerce WordPress plugin, affecting versions <= 2.12.5. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 2.12.6; sites on affected versions should update now. Disclosed October 2026, reported by R3D.

Vulnerability Overview

The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'member[ID]' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existing Welcart shop-member account's email address and password by supplying that member's numeric ID, then authenticate as that member to achieve full account takeover. The only authentication barrier is a wp_verify_nonce() check against a nonce printed to every unauthenticated visitor on the auto-published New Enrollment Form, meaning no existing account, no WordPress login, and no non-default configuration is required to exploit this vulnerability.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.

CWE-287: Improper Authentication

Welcart e-Commerce <= 2.12.5 carries this weakness at member[ID], and reaching it takes no account at all. Improper authentication means the mechanism that proves who a caller is can be satisfied without the secret it was supposed to require.

An attacker authenticates as another user — administrators included — without ever knowing a password, so password policies and login rate limits never come into play. For Welcart e-Commerce the fix is 2.12.6: builds <= 2.12.5 are affected, anything from 2.12.6 onward is not.

Remediation

Update to version 2.12.6, or a newer patched version

How does WordSec protect against this?

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: Welcart e-Commerce 2.12.6 closes this, and updating the plugin is the step that ends it.

  • Login Security
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2026-119166https://www.wordfence.com/threat-intel/vulnerabilities/id/e93b0ebf-576d-48d0-95f7-87135f45980fhttps://nvd.nist.gov/vuln/detail/CVE-2026-119166

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C