Is CVE-2026-119166 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119166 being exploited in the wild.

How severe is CVE-2026-119166?

Medium severity, with a CVSS score of 5.3, published 31 October 2026.

Which products and versions are affected?

Welcart e-Commerce up to and including 2.12.5.

Is there a fix for CVE-2026-119166?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-119166 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-119166?

Check whether you run Welcart e-Commerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119166: Welcart e-Commerce plugin IDOR in member account modification

CVE-2026-119166 · Severity: medium · CVSS 5.3 · Published 2026-10-31

Welcart is an e-commerce plugin for WordPress that manages online shops and customer accounts. An unauthenticated attacker can take over any shop member's account by changing their email and password through a flawed parameter validation, requiring only knowledge of the victim's user ID and access to the public enrollment form. This allows attackers to impersonate legitimate shop members and access their accounts without any WordPress login credentials.

Technologies: Welcart e-Commerce. Vendors: Welcart.

Quick answers

Is CVE-2026-119166 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119166 being exploited in the wild.
How severe is CVE-2026-119166?: Medium severity, with a CVSS score of 5.3, published 31 October 2026.
Which products and versions are affected?: Welcart e-Commerce up to and including 2.12.5.
Is there a fix for CVE-2026-119166?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-119166 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-119166?: Check whether you run Welcart e-Commerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin contains an Insecure Direct Object Reference (IDOR) vulnerability in the 'member[ID]' parameter due to insufficient input validation on user-controlled keys. An unauthenticated attacker can bypass the wp_verify_nonce() check (which uses a nonce printed to all visitors on the auto-published New Enrollment Form) to modify arbitrary member account credentials. The vulnerability requires only the target member's numeric ID, which is typically sequential and easily enumerable.

Affected products

Welcart e-Commerce up to and including 2.12.5

Timeline

2026-10-31: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.