Unauthorized Data Access in Welcart e-Commerce Plugin for WordPress

CVE-2025-12979

What is CVE-2025-12979?

The Welcart e-Commerce plugin for WordPress has a security flaw that allows unauthorized users to exploit the 'usces_export' action, resulting in access to sensitive payment credentials, business contact information, mail templates, and other critical settings associated with the online store. This vulnerability arises from a lack of proper capability checks in the plugin, making it essential for users to take preventative measures.

References