CVE-2026-15213: Welcart e-Commerce Auth Bypass Flaw

CVE-2026-15213 Overview

CVE-2026-15213 affects the Welcart e-Commerce WordPress plugin in versions prior to 2.11.33. The plugin fails to verify the authenticity of settlement callbacks for convenience-store and bank-transfer payment methods. An unauthenticated attacker can send a crafted request containing only an order number and a status flag to flip an order from unpaid to settled. The callback endpoint performs no signature validation, amount verification, or origin check. Because these are pay-later payment methods, an attacker can mark their own unpaid order as settled and receive fulfilment without ever transferring funds. This constitutes a business logic flaw combined with missing authentication on a state-changing endpoint.

Critical Impact
Unauthenticated attackers can mark their own orders as paid, obtaining goods or services without payment and causing direct financial loss to store operators.

Affected Products

Welcart e-Commerce WordPress plugin versions before 2.11.33
WordPress sites using Welcart with convenience-store settlement enabled
WordPress sites using Welcart with bank-transfer settlement enabled

Discovery Timeline

2026-08-12 - CVE-2026-15213 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-15213

Vulnerability Analysis

The vulnerability resides in the settlement callback handler used by Welcart's convenience-store and bank-transfer payment flows. In a standard payment integration, the payment processor notifies the merchant application when a customer completes payment. The merchant application must verify that the notification originated from the legitimate processor before updating order state.

Welcart's callback handler accepts inbound requests without cryptographic verification. The handler trusts an order identifier and a status flag supplied in the request, then transitions the associated order to a settled state. Because the endpoint is reachable over the network without authentication, any party who knows or can enumerate an order number can trigger the state change.

Root Cause

The root cause is missing authentication and missing integrity validation on a state-changing HTTP endpoint, categorized as a Business Logic Error combined with Missing Authorization. The handler does not validate a shared secret, HMAC signature, or source IP address associated with the payment processor. It also does not cross-check the reported payment amount against the order total.

Attack Vector

Exploitation requires network access to the target WordPress site and knowledge of a valid order number. An attacker places an order using convenience-store or bank-transfer payment, then issues a direct HTTP request to the callback endpoint containing that order number and a status flag indicating successful payment. The plugin marks the order as paid and the store proceeds with fulfilment. Order numbers may be predictable or recoverable from confirmation emails, receipts, or account pages, which lowers the barrier to abuse. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-15213

Indicators of Compromise

Unsolicited POST or GET requests to the Welcart settlement callback endpoint from IP addresses not associated with the configured payment processor.
Orders that transition from unpaid to settled without a corresponding entry in the payment processor's reconciliation report.
Fulfilled orders where the recorded settlement timestamp precedes any legitimate payment confirmation.

Detection Strategies

Compare daily settled-order counts in WordPress against settlement reports from the convenience-store or bank-transfer provider and flag discrepancies.
Enable WordPress request logging or place a web application firewall in front of the site to capture requests reaching plugin callback URLs.
Alert on repeated callback requests targeting sequential or enumerated order identifiers, which suggests brute-force abuse.

Monitoring Recommendations

Monitor web access logs for POST traffic to Welcart callback paths originating from unexpected geographic regions or autonomous systems.
Track order status transitions in the WordPress database and alert on transitions to settled that occur outside business hours or without prior processor communication.
Reconcile fulfilment activity against payment provider settlement files on at least a daily cadence.

How to Mitigate CVE-2026-15213

Immediate Actions Required

Upgrade the Welcart e-Commerce plugin to version 2.11.33 or later on all WordPress installations.
Audit recent orders paid via convenience-store or bank-transfer methods to identify any fulfilment without matching processor settlement records.
Temporarily disable convenience-store and bank-transfer payment options until the patch is applied if immediate upgrade is not feasible.

Patch Information

The vendor addressed CVE-2026-15213 in Welcart e-Commerce version 2.11.33. Site administrators should apply the update through the WordPress plugin management interface or by installing the updated package directly. Consult the WPScan Vulnerability Report for reference details.

Workarounds

Restrict access to the Welcart settlement callback endpoint using web server or WAF rules that allow only IP ranges published by the payment processor.
Disable convenience-store and bank-transfer settlement methods in the Welcart configuration until the patched version is deployed.
Add manual verification of pay-later order settlements against the payment processor's reconciliation reports before fulfilment.

bash

# Example nginx location block restricting callback access to processor IPs
location ~* /wp-content/plugins/usc-e-shop/.*callback {
    allow 203.0.113.0/24;   # replace with processor CIDR
    deny all;
}