CVE-2026-119166

The Welcart e-Commerce plugin for WordPress (versions up to and including 2.12.5 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a lack of validation on the 'member[ID]' parameter, allowing unauthenticated attackers to overwrite the email address and password of ...