Description

The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-12T12:17:46.690Z",
  "pubdate": "2026-08-12T12:17:46.690Z",
  "executiveSummary": "The Welcart e-Commerce WordPress plugin before 2.11.33 suffers from a missing authentication vulnerability within its convenience-store and bank-transfer settlement callback mechanism.\nThis flaw allows unauthenticated remote attackers to arbitrarily alter the payment status of orders from unpaid to settled.\nThe vulnerability directly impacts online merchants utilizing the affected payment settlement features by enabling fraudulent order fulfillment without requiring any financial transaction.\nThe risk implication is severe financial loss and inventory depletion due to unauthorized manipulation of e-commerce checkout flows.\nAttacker capabilities are limited to requiring valid target order numbers and knowledge of the vulnerable callback endpoint.\nExploitation requirements are minimal, as the endpoint accepts requests entirely devoid of cryptographic signatures, origin verification, or transaction amount validations.",
  "technicalDetails": "The vulnerability resides in the settlement callback handler for convenience-store and bank-transfer payment methods within the Welcart e-Commerce plugin, affecting all versions prior to 2.11.33.\nThe root cause of the vulnerability is the complete absence of input validation, cryptographic signature verification, and authentication checks on incoming settlement notification requests.\nThe vulnerable component blindly trusts incoming HTTP parameters specifically handling order identifiers and status flags.\nAuthentication and privilege requirements are entirely absent; the callback endpoint is exposed over the network to unauthenticated users without requiring any session tokens or administrative privileges.\nThe attack flow proceeds as follows: First, an attacker initiates a legitimate purchase on a vulnerable WordPress instance utilizing a pay-later method such as convenience-store or bank-transfer checkout, generating an unpaid target order number.\nSecond, rather than completing the fiat payment through authorized banking channels, the attacker crafts a malicious HTTP request directed at the plugin's settlement callback endpoint.\nThird, the attacker injects the previously obtained order number alongside an explicit status flag indicating a successful settlement state into the request parameters.\nFourth, because the vulnerable endpoint lacks cryptographic mechanisms like HMAC signatures, shared secrets, or IP whitelisting to verify the origin of the notification, the application processes the request.\nFinally, the internal order management logic updates the database record, transitioning the order status from unpaid to settled.\nThe payload behavior successfully tricks the e-commerce engine into treating fraudulent requests as legitimate financial callbacks from payment gateways.\nThe post-exploitation impact includes unauthorized order fulfillment, inventory theft, and circumvention of payment gateways without triggering alerts or requiring financial outlay."
}