CVE-2025-12979

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions prior to 2.11.25

Description The Welcart e-Commerce plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check on the usces export action. An unauthenticated attacker can access configured payment credentials (such as PayPal API secrets), business contact details, mail templates, and other operational settings tied to the store.

Recommendations Update to version 2.11.25 or later.