Insecure Direct Object Reference in Welcart e-Commerce Plugin for WordPress

CVE-2026-119166

What is CVE-2026-119166?

The Welcart e-Commerce plugin for WordPress has a security flaw that allows unauthenticated attackers to exploit the 'member[ID]' parameter. This flaw is caused by a lack of validation on a user-controlled key in all versions up to 2.12.5. By supplying the numeric ID of a Welcart shop-member account, an attacker can overwrite that member's email address and password, leading to a complete account takeover. The only barrier to authentication is a wp_verify_nonce() check against a nonce presented to every visitor on the New Enrollment Form, which leaves it vulnerable even to those without valid WordPress accounts.

References