Authorization Bypass in Welcart e-Commerce Plugin for WordPress

CVE-2021-4375

Summary

The Welcart e-Commerce plugin for WordPress contains a vulnerability characterized by an authorization bypass, stemming from a missing capability check in the usces_download_system_information() function. This flaw affects all versions up to and including 2.2.7. As a result, authenticated attackers can exploit this vulnerability to download sensitive information, which includes critical WordPress, plugin, PHP, and server settings. It is crucial for website administrators to apply patches and updates promptly to safeguard against potential exploitation.

References