Description

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary 'reserve' key/value pairs as order metadata during a public checkout, then invoke the callback with an attacker-chosen 'option' parameter to select and unserialize that metadata without any provider signature, source-address, transaction-identity or ownership check. A POP chain is present in the TCPDF library bundled with the plugin itself, so no additional plugin or theme is required. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, including wp-config.php, which can lead to remote code execution when an attacker re-runs the WordPress installer against a database they control. Successful exploitation is contingent on an admin printing an invoice to trigger file deletion.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-05T07:17:11.657Z",
  "pubdate": "2026-09-05T07:17:11.657Z",
  "executiveSummary": "The Welcart e-Commerce plugin for WordPress, in versions up to and including 2.12.1, contains a critical PHP Object Injection vulnerability. This flaw exists within the Telecom EDY payment callback mechanism, identified by the usces_action_acting_transaction function.\nThe vulnerability allows unauthenticated attackers to supply untrusted input that is subsequently deserialized without adequate validation. Because the plugin includes a vulnerable version of the TCPDF library, a Property-Oriented Programming (POP) chain is readily available to facilitate exploitation.\nThe primary impact of this vulnerability is arbitrary file deletion on the host server. Attackers can leverage this to delete sensitive files such as wp-config.php, which may subsequently permit a remote code execution (RCE) scenario by allowing the attacker to re-initialize the WordPress installation against a malicious database.\nSuccessful exploitation requires no prior authentication and no additional plugins, as all necessary components are bundled with Welcart. A secondary action, such as an administrator printing an invoice, is required to trigger the final stage of the payload execution. The flaw poses a severe risk to data integrity and server-side system control.",
  "technicalDetails": "The root cause of this vulnerability is the insecure deserialization of untrusted user input within the Telecom EDY payment callback, specifically handled by the usces_action_acting_transaction function. The plugin fails to verify the integrity, source, or ownership of data passed via the 'option' parameter, allowing an attacker to manipulate stored order metadata.\nExploitation follows a multi-stage attack flow. First, an unauthenticated attacker initiates a public checkout process. During this process, the attacker injects arbitrary 'reserve' key/value pairs into the order metadata. These pairs are stored by the plugin without sufficient sanitization or validation.\nOnce the metadata is stored, the attacker invokes the usces_action_acting_transaction callback. By supplying a specially crafted 'option' parameter, the attacker forces the application to unserialize the previously stored malicious metadata. Because the plugin lacks signature verification, source-address checks, or transaction-identity validation, the application processes the attacker-controlled input directly.\nThe vulnerability is weaponized using a POP chain residing in the TCPDF library bundled with the Welcart plugin. This library contains gadgets that, when triggered through the deserialization process, allow an attacker to achieve arbitrary file deletion. By targeting critical files like wp-config.php, the attacker can effectively wipe the existing WordPress configuration.\nThe post-exploitation impact is severe. Upon the deletion of wp-config.php, the WordPress installation process becomes accessible to an attacker. An attacker can re-run the WordPress installer, pointing the site to a database controlled by the attacker. This manipulation enables the attacker to gain full administrative control over the application environment, eventually leading to Remote Code Execution (RCE).\nThe vulnerability is exploitable over the network without authentication. While the deserialization and file deletion trigger rely on the existence of the POP chain in the bundled TCPDF library, the final deletion action is contingent upon an administrator interacting with the system—specifically by printing an invoice—which activates the gadget chain within the application's runtime context."
}