CyberRota Analysis
AI-GeneratedThe Welcart e-Commerce plugin for WordPress prior to version 2.11.33 is vulnerable due to a lack of authentication verification for settlement callbacks, allowing unauthenticated attackers to change an order's status from unpaid to settled using only an order number and status flag. This vulnerability can lead to unauthorized fulfillment of orders, enabling attackers to receive goods or services without payment. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential exploitation risks.
Original NVD Description
The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying.