---
id: "CVE-2026-119166"
kind: "vulnerability"
aliases: ["CVE-2026-119166"]
title: "Welcart e-Commerce plugin lets visitors take over any shop member account"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["e-commerce", "package", "self-hosted", "welcart", "wordpress"]
not_affected_if: ["newer-version", "plugin-not-installed"]
published_at: "2026-10-31T07:16:36+00:00"
first_seen_at: "2026-10-31T07:34:07+00:00"
updated_at: "2026-10-31T07:34:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119166", "first_seen_at": "2026-10-31T07:34:07+00:00"}]
---

# Welcart e-Commerce plugin lets visitors take over any shop member account

The Welcart e-Commerce WordPress plugin up to and including 2.12.5 accepts a user-supplied member ID that lets an unauthenticated visitor overwrite another member's email address and password. An attacker can then log in as that member and take over the account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Welcart e-Commerce plugin version in the WordPress admin under Plugins; affected versions are `2.12.5` and below.
- Look for the New Enrollment Form page on the site, which the description says is published automatically.

## Fix

- Welcart e-Commerce: move to a version later than `2.12.5` (the sources do not name the fixed release).

## Timeline

- 2026-10-31T07:34:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119166

## From the sources

The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'member[ID]' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existing Welcart shop-member account's email address and password by supplying that member's numeric ID, then authenticate as that member to achieve full account takeover. The only authentication barrier is a wp_verify_nonce() check against a nonce printed to every unauthenticated visitor on the auto-published New Enrollment Form, meaning no existing account, no WordPress login, and no non-default configuration is required to exploit this vulnerability.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_