Welcart e-Commerce Missing Authorization Vulnerability Allowing Unauthenticated Data Exposure

A vulnerability exists in the Welcart e-Commerce plugin for WordPress, in all versions through 2.11.24, due to a missing capability check on the 'usces_export' action. This flaw allows unauthenticated attackers to access sensitive information, including payment credentials (such as PayPal API secrets), business contact details, mail templates, and other operational settings related to the store.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive business information and payment credentials.

Remediation

Users can update to version 2.11.25 or a newer patched version to address this vulnerability.