CVE-2025-15671
Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.
| Vendor | unknown |
| Product | welcart e-commerce |
| Published | Aug 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown welcart e-commerce
Be the first to know when new unknown vulnerabilities affecting unknown welcart e-commerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Welcart e-Commerce
0 < 2.12.1
References
Credits
bRpsd WPScan