CVE-2025-15671: Welcart e-Commerce Session Fixation Vulnerability

CVE-2025-15671 Overview

CVE-2025-15671 is a session fixation vulnerability in the Welcart e-Commerce WordPress plugin before version 2.12.1. The plugin does not regenerate the session identifier upon authentication and accepts the session identifier from a user-supplied request parameter. An unauthenticated attacker can craft a request that pre-sets a shop member's session identifier. When the victim logs in through the attacker-crafted request, the attacker takes over the customer account. The flaw is categorized under [CWE-287: Improper Authentication].

Critical Impact
Attackers can hijack shop member accounts by fixating session identifiers before victim authentication, exposing customer data and order history.

Affected Products

Welcart e-Commerce WordPress plugin versions prior to 2.12.1
WordPress sites running vulnerable Welcart e-Commerce installations
Customer-facing WordPress e-commerce deployments using Welcart shop member accounts

Discovery Timeline

2026-08-21 - CVE-2025-15671 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2025-15671

Vulnerability Analysis

The Welcart e-Commerce plugin mishandles session state during the authentication flow. Two defects combine to produce the vulnerability. First, the plugin accepts a session identifier supplied through a request parameter rather than generating one server-side. Second, the plugin fails to regenerate that identifier after successful authentication. This pattern violates standard session management practice under [CWE-287].

An attacker exploits this by sending a victim a link that embeds an attacker-known session identifier. When the victim authenticates through that link, the server binds the victim's authenticated session to the identifier the attacker already holds. The attacker then reuses the identifier to access the victim's shop member account, including saved addresses, order history, and any stored purchase context.

Exploitation requires user interaction, since the victim must click the attacker-crafted link and log in. The attacker does not need prior authentication or privileges on the target site.

Root Cause

The plugin trusts a client-supplied session identifier and does not rotate the identifier at the authentication boundary. Secure session handling requires the server to issue a fresh identifier after login and to reject attacker-influenced identifiers on session creation.

Attack Vector

The attack is network-based and depends on social engineering. The attacker generates a session identifier, embeds it in a URL parameter pointing at the vulnerable Welcart-powered site, and delivers the URL to the victim via email, chat, or a malicious page. Once the victim logs in, the attacker's pre-set session identifier becomes authenticated and grants account access.

No verified public exploit code is available. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2025-15671

Indicators of Compromise

Inbound requests to Welcart login endpoints containing session identifier parameters in the query string or POST body
Multiple authenticated sessions using the same session identifier originating from different IP addresses or user agents
Shop member account activity (address changes, order lookups) from geographies inconsistent with the account owner

Detection Strategies

Inspect web server access logs for authentication requests carrying externally supplied session identifiers
Correlate session identifier reuse across distinct client fingerprints within short time windows
Alert on WordPress wp-login and Welcart shop member login flows that do not produce a new session cookie after successful authentication

Monitoring Recommendations

Forward WordPress access logs and Welcart authentication events to a centralized log platform for correlation
Track anomalies in shop member session lifetime, IP churn, and user-agent transitions post-login
Monitor customer support tickets citing unauthorized order or profile changes as a downstream signal of account takeover

How to Mitigate CVE-2025-15671

Immediate Actions Required

Update the Welcart e-Commerce WordPress plugin to version 2.12.1 or later on all affected sites
Invalidate all active shop member sessions and require re-authentication after upgrading
Audit shop member accounts for unauthorized profile changes, address additions, or suspicious orders since the plugin was installed

Patch Information

Upgrade the Welcart e-Commerce plugin to version 2.12.1 or later. The fixed release regenerates the session identifier on authentication and stops accepting client-supplied session identifiers. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict access to Welcart login endpoints behind a web application firewall rule that strips session identifier parameters from inbound requests
Disable the Welcart shop member login feature until the plugin is patched if e-commerce operations can be paused
Enforce short session lifetimes and require re-authentication for sensitive shop member actions such as order placement and profile edits

bash

# Configuration example
wp plugin update usc-e-shop --version=2.12.1
wp user session destroy --all