UNKNOWN NVD

CVE-2025-15671

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-s

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.

References

https://wpscan.com/vulnerability/3b2d4e7f-1e2a-4712-af9b-50080106d52c/

Published: 2026-08-21 · Source: NVD · Feed updated: 2026-08-21

This unknown severity vulnerability was published on 2026-08-21 via NVD.

vulnfeed aggregates 9913 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.