CVE-2026-19887 uscnanbu CVE debrief

Who should care

WordPress site administrators and defenders who use the Welcart e-Commerce plugin should assess their exposure and apply patches or updates to fix the vulnerability. This vulnerability requires immediate attention due to its high CVSS score and potential impact.

Why it matters

CVE-2026-19887 is a high-severity vulnerability in the Welcart e-Commerce plugin for WordPress, allowing unauthenticated attackers to potentially delete files and execute remote code. WordPress site administrators and defenders should assess exposure and apply patches or updates to fix the vulnerability.

• File deletion, potentially leading to remote code execution
• Unauthenticated attackers can exploit the vulnerability
• High CVSS score of 8.8 indicating high severity
• Requires verification of affected versions and patching

Technical summary

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1. The vulnerability is caused by deserialization of untrusted input in the Telecom EDY payment callback. Unauthenticated attackers can store arbitrary 'reserve' key/value pairs as order metadata during a public checkout, then invoke the callback with an attacker-chosen 'option' parameter to select and unserialize that metadata without any provider signature, source-address, transaction-identity or ownership check. A POP chain is present in the TCPDF library bundled with the plugin itself, allowing for file deletion and potentially remote code execution when an attacker re-runs the WordPress installer against a database they control.

Defensive priority

High priority for WordPress site administrators and defenders to assess exposure and apply patches

Recommended defensive actions

• Assess exposure by checking if the Welcart e-Commerce plugin version is 2.12.1 or earlier
• Apply patches or updates provided by the vendor to fix the vulnerability
• Monitor for suspicious activity related to the Telecom EDY payment callback
• Consider implementing additional security measures to protect against PHP Object Injection attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 8.8 and the affected plugin version. However, the corpus does not establish versions beyond 2.12.1, exploitation, impact, or remediation beyond patching.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.