Executive brief
Welcart e-Commerce is a WordPress plugin that enables online store functionality for WordPress sites. The plugin fails to properly regenerate session identifiers during customer login, allowing an attacker to pre-fix a victim's session ID and hijack their customer account after they log in via a malicious link. An attacker with no legitimate credentials can then access the victim's account, personal information, and order history.
Technical details
The vulnerability is a session fixation flaw (CWE-287) in the Welcart e-Commerce WordPress plugin before version 2.12.1. The plugin accepts a user-supplied uscesid parameter to set the session identifier and fails to call session_regenerate_id() when this parameter is present during login, even after successful authentication. An attacker can craft a specially encoded uscesid value, trick a victim into logging in via an attacker-controlled form that includes this fixed session ID, and then use only the known session ID to impersonate the authenticated victim. The attack requires user interaction (victim must log in via attacker's crafted request) but bypasses all authentication controls once the session is hijacked. The vulnerability was fixed in version 2.12.1.
Affected products
- Welcart e-Commerce before 2.12.1
Timeline
- 2026-08-19: disclosed
- 2026-02-26: patched: Fixed in version 2.12.1