Session Fixation Vulnerability in Welcart e-Commerce Plugin for WordPress
CVE-2025-15671
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 21 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-15671?
The Welcart e-Commerce plugin for WordPress prior to version 2.12.1 is susceptible to a session fixation vulnerability. This allows an unauthenticated attacker to manipulate the session identifier by supplying a crafted request parameter. Consequently, if a victim logs in after being lured, the attacker can take control of the victim's shop account, resulting in unauthorized access and actions within the e-commerce environment.
Affected Version(s)
Welcart e-Commerce 0 < 2.12.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.