CVE-2026-15213

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce WordPress plugin versions prior to 2.11.33

Description The plugin fails to verify the authenticity of the convenience-store and bank-transfer settlement callback. An unauthenticated request can change an order status from unpaid to settled using only an order number and a status flag, as the system does not perform signature, amount, or origin checks. This allows an attacker to mark their own unpaid orders as settled to obtain fulfillment without payment.

Recommendations Update the plugin to version 2.11.33 or later.