CVE-2025-15671

If you're running Welcart or any Welcart-based e-commerce site, this CVE demands immediate attention despite its misleading 5.4 CVSS score. The vulnerability is session fixation — the plugin does not regenerate the session identifier after authentication — but framing it as a generic session fixation vastly understates your actual exposure. When an attacker hijacks a Welcart customer session, they're not accessing a forum profile. They're accessing an account that stores payment methods, order history, shipping addresses, and checkout profiles containing PII. Every compromised session is immediately monetizable fraud infrastructure without requiring any additional vulnerability discovery. The EPSS score of 0.00177 compounds this mischaracterization. That metric measures script kiddie automation probability, not whether a targeted attacker with a customer email list can run this operationally. Phishing a legitimate customer with a crafted login link that embeds the attacker's session ID takes seconds and has high reliability. Automated scanning won't find it, but a financially motivated actor targeting your customer base absolutely will. Prioritize this patch. The CVSS score routes it into a lower-priority queue in most patch management systems, but your actual risk profile is closer to critical — this is account takeover with direct access to stored financial data. Beyond applying the vendor patch, audit your access logs for sessions that originate from unexpected IP ranges or exhibit abnormal order behavior. More importantly, recognize that session fixation in payment-adjacent code is a known pattern with deep roots in the WordPress plugin ecosystem. If this plugin has gone years without addressing session regeneration, the underlying session architecture likely contains other forgotten weaknesses — other plugins handling payments or customer data on your site deserve the same scrutiny.

Reviewed through automated stages and approved by a human before publication.