The vulnerability allows an unauthenticated attacker to set the session identifier of a user by supplying the uscesid parameter in a request. Because the Welcart e‑Commerce plugin does not regenerate the session ID upon authentication, the attacker can fixate a shop member’s session before the member logs in. After the member logs in, the attacker is effectively in control of the member’s customer account, enabling unauthorized access to confidential data and the ability to perform actions as the member.

All installations of the Welcart e‑Commerce WordPress plugin that are older than version 2.12.1 are affected. The plugin is distributed by an unknown vendor under the name Welcart e‑Commerce.

The EPSS score is < 1%, and the vulnerability is not listed in CISA KEV. Nonetheless, the lack of regeneration of the session identifier during login creates a high‑impact scenario: any user who logs in can have their session hijacked by an attacker who only needs to craft a URL containing the uscesid parameter. Because this attack can be performed over the public web without privileged credentials, the risk level is medium, with a CVSS score of 5.4. The vulnerability can be exploited by sending a malicious request to a victim, after which the attacker can control the customer account.