Description

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-21T07:16:22.960Z",
  "pubdate": "2026-08-21T07:16:22.960Z",
  "executiveSummary": "The Welcart e-Commerce WordPress plugin before 2.12.1 is susceptible to a session fixation vulnerability arising from improper session identifier management during the authentication lifecycle. This security flaw enables an unauthenticated remote attacker to pre-define and fixate the session identifier of a targeted shop member by supplying a malicious request parameter. Consequently, if the victim authenticates using an attacker-crafted request incorporating this predetermined session identifier, the attacker can hijack the established session and achieve full account takeover of the victim customer account. The vulnerability introduces significant risk to e-commerce operations by undermining user trust, exposing sensitive customer Personally Identifiable Information (PII), and potentially facilitating unauthorized transactions or data manipulation. Exploitation requires no prior authentication or elevated privileges, though it relies on social engineering or user interaction to induce the victim into authenticating via the crafted request.",
  "technicalDetails": "The root cause of this vulnerability lies in two distinct security weaknesses within the session handling mechanism of the affected Welcart e-Commerce plugin versions prior to 2.12.1. First, the application fails to regenerate the cryptographic session identifier upon a successful authentication event, which is a critical security control required to prevent session fixation attacks. Second, the plugin explicitly accepts and sets the active session identifier directly from a user-supplied request parameter rather than exclusively generating and managing identifiers server-side. This combination allows an external entity to initialize a session context with a known, attacker-controlled identifier. The attack flow proceeds as follows: an unauthenticated attacker crafts a malicious URL or request containing a specific session identifier parameter targeted at the vulnerable WordPress site utilizing the Welcart e-Commerce plugin. The attacker then delivers this crafted request to a prospective victim shop member via phishing or other social engineering vectors. When the victim accesses the site and interacts with the authentication mechanism using the provided request, the application binds the ongoing authenticated session to the attacker-supplied session identifier instead of issuing a fresh token. Because the session identifier remains unchanged throughout the login process, the attacker retains knowledge of the valid session token associated with the victim's authenticated state. Post-exploitation impact includes complete session hijacking and subsequent account takeover, granting the attacker unauthorized access to the victim's customer account dashboard, order history, stored payment profiles, and associated personal data. The vulnerability is network-exploitable, requires zero privileges or prior authentication, and affects the session management component of all Welcart e-Commerce installations running versions prior to 2.12.1."
}