CVE-2026-19887

The Welcart e-Commerce plugin for WordPress (all versions up to and including 2.12.1) is vulnerable to unauthenticated PHP Object Injection (CWE-502) through deserialization of untrusted input in its Telecom EDY payment callback (usces_action_acting_transaction). An attacker first stores arbitrary 'reserve' key/value pairs as order metadata during a public checkout, then invokes the callback with an attacker-chosen 'option' parameter, which unserializes that metadata with no provider signature, source-address, transaction-identity, or ownership check. A POP chain in the TCPDF library bundled with the plugin itself lets unauthenticated attackers delete arbitrary files on the server, including wp-config.php, leading to remote code execution if the attacker re-runs the WordPress installer against a database they control. Any WordPress site running an affected version of the plugin is exposed, though successful file deletion only occurs when an admin prints an invoice. There is no known in-the-wild exploitation or public proof-of-concept; EPSS is 0.6% and the flaw is not in CISA KEV.

What to do: Update Welcart e-Commerce to the patched release beyond 2.12.1 as soon as it is available, since every version through 2.12.1 is affected. If patching is delayed, restrict or disable the Telecom EDY callback path and be aware that file deletion only fires when an admin prints an invoice, so elevated accounts should exercise caution until the plugin is updated. After patching, verify wp-config.php and other critical files are intact, and harden database credentials since the RCE path depends on the attacker reaching the database through the WordPress installer.