The vulnerability in Welcart e‑Commerce, up to version 2.12.1, is a PHP Object Injection that allows attackers to store arbitrary metadata in a public checkout and subsequently trigger a callback that deserializes that data. Because the callback contains a property‑overloading chain in TCPDF, an attacker can delete any file on the server, including wp‑config.php. Removal of this critical configuration file can enable an attacker to reinstall WordPress on a database they control, leading to full remote code execution. This flaw was scored CVSS 8.8 and is not currently listed in CISA’s KEV catalog.

All installations of the Welcart e‑Commerce plugin for WordPress running version 2.12.1 or earlier. The issue is tied to the Telecommunication EDY payment callback and the bundled TCPDF library, so any site that has the plugin installed and the callback enabled is susceptible, regardless of theme or other plugins.

The CVSS score of 8.8 indicates high severity, and while no EPSS value is available, the vulnerability requires an unauthenticated user to perform a checkout to embed malicious metadata and later an administrator to print an invoice to trigger the deletion. Because the operation requires only publicly visible actions and no authentication, the probability of exploitation is significant on exposed sites. The flaw does not require additional code from other plugins or themes; the bundled TCPDF library already provides the property chain. The lack of authentication or signature verification during the callback makes the exploit straightforward and fully controllable by an attacker.