CVE-2026-19887
Received Received - Intake

PHP Object Injection in Welcart e-Commerce Plugin

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: Wordfence

Description
The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attackers can store arbitrary 'reserve' key/value pairs as order metadata during a public checkout, then invoke the callback with an attacker-chosen 'option' parameter to select and unserialize that metadata without any provider signature, source-address, transaction-identity or ownership check. A POP chain is present in the TCPDF library bundled with the plugin itself, so no additional plugin or theme is required. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, including wp-config.php, which can lead to remote code execution when an attacker re-runs the WordPress installer against a database they control. Successful exploitation is contingent on an admin printing an invoice to trigger file deletion.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-19887
EUVD
EUVD-2026-71883

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
welcart welcart_e-commerce to 2.12.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a PHP Object Injection flaw in the Welcart e-Commerce WordPress plugin up to version 2.12.1. It allows unauthenticated attackers to inject malicious serialized data via the Telecom EDY payment callback. The plugin fails to validate input properly, enabling attackers to store arbitrary data as order metadata during checkout. Later, they can trigger deserialization of this data without checks, leading to arbitrary file deletion or remote code execution.

Detection Guidance

Detecting this vulnerability requires checking for the presence of the Welcart e-Commerce plugin versions up to 2.12.1 and monitoring for unusual file deletion or deserialization activity. Inspect WordPress plugins for the Welcart e-Commerce plugin and verify its version. Check server logs for suspicious callback invocations to usces_action_acting_transaction with attacker-chosen option parameters.

Impact Analysis

If exploited, this vulnerability can allow attackers to delete critical files like wp-config.php, disrupting your WordPress site. It may also enable remote code execution if an admin triggers file deletion by printing an invoice. Unauthorized file access or site takeover could occur without requiring authentication.

Compliance Impact

This vulnerability could lead to unauthorized data access or deletion, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may compromise protected health information integrity. Compliance failures could result in legal penalties, reputational damage, and loss of trust due to potential data breaches or unauthorized modifications.

Mitigation Strategies

Immediately update the Welcart e-Commerce plugin to the latest version beyond 2.12.1. Disable the Telecom EDY payment callback if not in use. Implement strict input validation for all serialized data. Monitor server file integrity and restrict access to sensitive files like wp-config.php.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19887. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart