Authorization Bypass Vulnerability in Welcart e-Commerce Plugin for WordPress

CVE-2021-4355

Summary

The Welcart e-Commerce plugin for WordPress suffers from an authorization bypass vulnerability due to inadequate capability checks in key functions. This issue, present in versions up to and including 2.2.7, can allow unauthenticated attackers to access sensitive information, including lists of members, products, and orders, through admin_init hooks. As a result, attackers may exploit this vulnerability to gain unauthorized access to critical data, posing a significant risk to the integrity of the e-commerce platform.

References