Vulnerability · Published Aug 12, 2026 · Assigned by WPScan

CVE-2026-15213Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback

Medium 5.3

In plain English

A medium-severity security flaw in Welcart e-Commerce from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 95.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Welcart e-Commerce	0 – before 2.11.33

References

https://wpscan.com/vulnerability/4ca89701-8abc-4ecb-9834-a648ab1c4da1/ exploit, vdb-entry, technical-description