CVE-2026-119166
Received Received - Intake

Insecure Direct Object Reference in Welcart e-Commerce Plugin

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'member[ID]' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existing Welcart shop-member account's email address and password by supplying that member's numeric ID, then authenticate as that member to achieve full account takeover. The only authentication barrier is a wp_verify_nonce() check against a nonce printed to every unauthenticated visitor on the auto-published New Enrollment Form, meaning no existing account, no WordPress login, and no non-default configuration is required to exploit this vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-119166
EUVD
EUVD-2026-114615

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
uscnanbu Welcart e-Commerce 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Welcart e-Commerce plugin for WordPress has an Insecure Direct Object Reference vulnerability in versions up to 2.12.5. It allows unauthenticated attackers to change any shop member's email and password by exploiting the 'member[ID]' parameter. The attacker only needs to know the numeric ID of a member and bypass a weak nonce check to take over the account.

Detection Guidance

To detect this vulnerability, check for unauthorized modifications to user accounts in the Welcart e-Commerce plugin. Look for unexpected changes to email addresses or passwords in the WordPress database under the wp_usermeta table. Review server logs for unusual requests targeting the 'member[ID]' parameter in the New Enrollment Form.

Impact Analysis

If you use the vulnerable Welcart plugin, attackers could take over any user account by changing passwords and emails. This could lead to unauthorized access to sensitive data, financial transactions, or administrative controls. Even non-logged-in users can exploit this without special configuration.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements. For HIPAA, it risks exposing protected health information. Compliance failures may result in legal penalties, fines, or reputational damage due to compromised user accounts and data breaches.

Mitigation Strategies

Update the Welcart e-Commerce plugin to the latest version beyond 2.12.5 to patch the insecure direct object reference vulnerability. Disable the auto-published New Enrollment Form if not required to reduce exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119166. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart