CVE-2026-119166

The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'member[ID]' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existing Welcart shop-member account's email address and password by supplying that member's numeric ID, then authenticate as that member to achieve full account takeover. The only authentication barrier is a wp_verify_nonce() check against a nonce printed to every unauthenticated visitor on the auto-published New Enrollment Form, meaning no existing account, no WordPress login, and no non-default configuration is required to exploit this vulnerability.

• CWE-287

• https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/classes/usceshop.class.php#L3848
• https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/classes/usceshop.class.php#L4470
• https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/classes/usceshop.class.php#L5070
• https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/classes/usceshop.class.php#L5509
• https://plugins.trac.wordpress.org/changeset/3760784/usc-e-shop
• https://plugins.trac.wordpress.org/changeset/3760784/usc-e-shop/trunk/classes/usceshop.class.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e93b0ebf-576d-48d0-95f7-87135f45980f?source=cve

Published

Oct 31, 2026

Last Modified

Oct 31, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-119146ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overfl…5.6
• CVE-2026-119147ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorizatio…4.3
• CVE-2026-119148Incomplete string validation in AWS aws-nitro-enclaves-sdk-c…6.5
• CVE-2026-11915vulnerability in Drupal Brute force attack protection allows…5.9
• CVE-2026-119162The User Submitted Posts – Enable Users to Submit Posts from…7.2
• CVE-2026-119163The FunnelKit Automations – Email Marketing Automation and C…7.5
• CVE-2026-119168HashiCorp Nomad and Nomad Enterprise are vulnerable to symli…8.8
• CVE-2026-11917A path traversal security issue exists within Rockwell Autom…7.2
• CVE-2026-119176The CP Multi View Events Calendar plugin for WordPress is vu…6.4
• CVE-2026-11918IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge…5.4
• CVE-2026-119186Forge (also called node-forge) is a native implementation of…5.9
• CVE-2026-119187Forge (also called node-forge) is a native implementation of…7.5