CVE-2026-19887 Overview
The Welcart e-Commerce plugin for WordPress contains a PHP Object Injection vulnerability in all versions up to and including 2.12.1. The flaw resides in the Telecom EDY payment callback handler usces_action_acting_transaction, which deserializes untrusted input from order metadata without validating provider signatures, source addresses, transaction identity, or ownership. Unauthenticated attackers can store arbitrary reserve key/value pairs during a public checkout, then invoke the callback with an attacker-chosen option parameter to trigger unserialize() on that metadata. A POP chain in the bundled TCPDF library enables arbitrary file deletion. This vulnerability is tracked under CWE-502.
Critical Impact
Unauthenticated attackers can delete arbitrary files including wp-config.php, enabling remote code execution when the WordPress installer is re-run against an attacker-controlled database.
Affected Products
- Welcart e-Commerce plugin for WordPress (usc-e-shop)
- All versions up to and including 2.12.1
- Bundled TCPDF library (POP chain gadget source)
Discovery Timeline
- 2026-09-05 - CVE-2026-19887 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-19887
Vulnerability Analysis
The Welcart e-Commerce plugin exposes a deserialization sink through the Telecom EDY payment integration. During a public checkout, an unauthenticated user can inject arbitrary reserve key/value pairs that are persisted as order metadata. When the callback endpoint usces_action_acting_transaction is invoked with an attacker-chosen option parameter, the plugin retrieves the matching metadata and passes it to unserialize() without any authentication, ownership, or origin checks.
Exploitation does not require a third-party plugin or theme. The bundled TCPDF library contains a Property-Oriented Programming (POP) chain that terminates in a file deletion primitive. Attackers can craft a serialized object graph that, once deserialized, deletes arbitrary files on the server, including wp-config.php. Removing wp-config.php allows an attacker to re-run the WordPress installer and point it at a database they control, yielding administrative access and remote code execution through the plugin/theme editor.
Root Cause
The root cause is unsafe deserialization of user-supplied data [CWE-502]. The payment callback trusts client-supplied metadata previously written during checkout and passes it directly to unserialize(). There is no HMAC or signature validation, no verification that the callback originates from Telecom EDY, and no check binding the transaction to the requesting session.
Attack Vector
The attack occurs over the network with low complexity and requires no authentication. The exploitation chain proceeds in two stages. First, the attacker performs a public checkout to persist a serialized payload as reserve order metadata. Second, the attacker calls the payment callback with the matching option parameter to trigger deserialization and the TCPDF POP chain. File deletion is contingent on an administrator subsequently printing an invoice, which loads TCPDF and executes the destructor gadget.
Refer to the Wordfence Vulnerability Report and the WordPress Order Data Class Code for the vulnerable sink.
Detection Methods for CVE-2026-19887
Indicators of Compromise
- Requests to usces_action_acting_transaction containing an option parameter from unauthenticated sources.
- Checkout requests with unusually long or binary-looking reserve field values consistent with PHP serialized objects (O:, a:, s: prefixes).
- Missing or unexpectedly modified wp-config.php, or the presence of install.php executions after a callback event.
- New administrator accounts created shortly after invoice-print activity in wp-admin.
Detection Strategies
- Inspect web server access logs for POST requests to the Welcart payment callback endpoint with atypical parameter payloads.
- Alert on write access to wp-config.php and related core configuration files by the PHP-FPM or web server user.
- Correlate anonymous checkout activity with subsequent admin invoice-print requests to identify the two-stage exploitation pattern.
Monitoring Recommendations
- Enable file integrity monitoring on the WordPress root directory, with priority on wp-config.php and wp-content/plugins/usc-e-shop/.
- Log and retain full HTTP request bodies for payment callback endpoints to enable retrospective payload analysis.
- Monitor for anomalous WordPress installer activity (/wp-admin/install.php) after the plugin is installed.
How to Mitigate CVE-2026-19887
Immediate Actions Required
- Update the Welcart e-Commerce plugin to version 2.12.2 or later immediately.
- Audit wp-config.php integrity and confirm no unauthorized administrator accounts exist.
- Restrict administrator access to invoice printing until the plugin has been patched.
- Review web server and application logs for prior exploitation attempts against usces_action_acting_transaction.
Patch Information
The vendor addressed the vulnerability in Welcart 2.12.2. See WordPress Changeset #3673344 and the full 2.12.1 to 2.12.2 diff for the code changes that remove the unsafe deserialization path.
Workarounds
- If patching is not immediately possible, disable the Welcart e-Commerce plugin until the update can be applied.
- Block unauthenticated requests to usces_action_acting_transaction at a web application firewall (WAF) using rules targeting serialized-object patterns in the reserve and option parameters.
- Restrict outbound network access from the WordPress host to prevent attacker-controlled database connections following any wp-config.php deletion.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
