{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-119166","assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","state":"PUBLISHED","assignerShortName":"Wordfence","dateReserved":"2026-10-29T15:00:05.476Z","datePublished":"2026-10-31T06:44:23.561Z","dateUpdated":"2026-10-31T06:44:23.561Z"},"containers":{"cna":{"providerMetadata":{"orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence","dateUpdated":"2026-10-31T06:44:23.561Z"},"affected":[{"vendor":"uscnanbu","product":"Welcart e-Commerce","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.12.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'member[ID]' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existing Welcart shop-member account's email address and password by supplying that member's numeric ID, then authenticate as that member to achieve full account takeover. The only authentication barrier is a wp_verify_nonce() check against a nonce printed to every unauthenticated visitor on the auto-published New Enrollment Form, meaning no existing account, no WordPress login, and no non-default configuration is required to exploit this vulnerability."}],"title":"Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e93b0ebf-576d-48d0-95f7-87135f45980f?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/classes/usceshop.class.php#L4470"},{"url":"https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/classes/usceshop.class.php#L5509"},{"url":"https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/classes/usceshop.class.php#L5070"},{"url":"https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/classes/usceshop.class.php#L3848"},{"url":"https://plugins.trac.wordpress.org/changeset/3760784/usc-e-shop"},{"url":"https://plugins.trac.wordpress.org/changeset/3760784/usc-e-shop/trunk/classes/usceshop.class.php"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-287 Improper Authentication","cweId":"CWE-287","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM"}}],"credits":[{"lang":"en","type":"finder","value":"R3D"}],"timeline":[{"time":"2026-10-29T15:17:19.000Z","lang":"en","value":"Vendor Notified"},{"time":"2026-10-30T17:51:17.000Z","lang":"en","value":"Disclosed"}]}}}