Welcart settlement callbacks permit payment-notification spoofing
Welcart e-Commerce before 2.11.33 accepts unauthenticated convenience-store and bank-transfer settlement notifications without proving they came from the payment provider. In the representative Epsilon path, EPSILON_SETTLEMENT::acting_transaction() accepts POST trans_code, user_id, order_number and paid; paid=1 resolves the attacker-supplied order through its stored settlement ID and passes it to usces_change_order_receipt() as receipted. An attacker who knows their own unpaid order number can therefore mark it paid and potentially obtain fulfilment without payment. Version 2.11.33 adds source-origin validation to provider notification paths. The reporter's exact targeted provider remains undisclosed until August 24.
- Component
- Welcart e-Commerce
- Plugin slug
usc-e-shop- Affected
- < 2.11.33
- Safe version
2.11.33- Published
- Aug 12, 2026
- Weakness
- Not assigned
This CVE was published Aug 12, 2026 and is one of 18 known issues for this plugin.
Update, patch or deactivate.
Update to 2.11.33 or later. Reconcile settled Welcart orders with payment-provider records, correct spoofed order states, and pause fulfilment for unmatched notifications.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N