CVE-2025-15671 — Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter
The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request p…
Published: 2026-08-21 · CVSS: 5.4 · CVSS 3.1
The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7