CVE-2025-15671

The Welcart e-Commerce WordPress plugin before 2.12.1 accepts a session identifier from the user-supplied uscesid parameter and never regenerates it after login, enabling unauthenticated session fixation and account takeover via a crafted link. Update to 2.12.1. Exploitation details are not provi...