CVE-2026-15213

Executive Summary

CVE-2026-15213 is an integrity/authentication deficiency in the Welcart e-Commerce WordPress plugin (all versions before 2.11.33) that affects its convenience-store (konbini) and bank-transfer settlement callback handling. An unauthenticated remote attacker can submit a bare order number and a status flag to the settlement callback and transition an unpaid order to "settled", without any signature, amount, or origin verification. The business impact is direct financial loss: an attacker can obtain goods or services without paying, and the merchant only discovers the fraud after fulfilment has already occurred.

Technical Analysis

The vulnerability class is "insufficient verification of data authenticity" (CWE-345), with secondary characteristics of missing authentication for a critical state-changing function (CWE-306). The flaw sits in the payment-settlement callback flow for pay-later methods: convenience-store payments and bank transfers are asynchronous, offline payment rails. When a customer pays at a physical terminal or initiates a transfer, the payment provider subsequently notifies the merchant's site via a server-to-server callback so the order can be marked as paid.

In Welcart versions prior to 2.11.33, this callback is accepted as authoritative without any proof that it originated from the legitimate payment provider. According to the NVD description, the state transition from "unpaid" to "settled" is driven purely by two attacker-controlled values: an order number and a status flag. There is no:

• Signature / HMAC check — the request is not authenticated or signed;
• Amount check — the callback does not confirm that the reported payment amount matches the order total;
• Origin check — the request is not required to come from a known payment gateway IP or network.

Because the affected methods are pay-later (the customer receives the goods first, paying later), the vulnerable callback is effectively a free-ordering primitive. The attack surface is any WordPress instance with Welcart installed and at least one of these settlement methods enabled. The callback endpoint is reachable over the network with no authentication (CVSS PR:N, UI:N, AC:L), meaning any internet user can trigger it.

The CVSS base score of 5.3 reflects the limited CIA profile (Confidentiality: None, Integrity: Low, Availability: None). The scoring captures the fact that only order-state integrity is compromised, not data disclosure or service availability. Note that CVSS does not directly model financial/order-fulfilment loss, so the real-world business impact for an e-commerce operator is typically higher than the numeric score suggests.

EPSS places this CVE at 0.00111 (1.5th percentile of exploited CVEs), indicating low current probability of exploitation in the wild. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and no threat-actor campaigns have been publicly attributed to this CVE at the time of writing.

Exploitation Scenarios

No public PoC was available at the time of analysis; the attack chain below is inferred strictly from the NVD description and the vulnerability class.

1. Reconnaissance / target identification. An attacker identifies WordPress sites running Welcart through plugin fingerprinting (e.g., Shodan/Censys queries, inspecting page source for plugin asset paths, or observing the site's checkout behaviour). The attacker confirms that convenience-store or bank-transfer payment methods are offered at checkout — these expose the vulnerable callback path.

2. Triggering the flaw class. The attacker begins a normal checkout with the pay-later method and obtains an order number without making any payment. No account compromise is required; the attacker can place the order as a guest if the shop permits it. This step is identical to legitimate customer behaviour and will not raise flags.

3. Payload / execution method. The attacker crafts an unauthenticated HTTP request to the settlement callback endpoint of the plugin. The request carries the order number and a status flag indicating "paid" or "complete". Because the plugin performs no signature, amount, or origin verification in affected versions, this single request is sufficient to flip the order from "unpaid" to "settled". No cryptographic token, gateway credential, or amount-matching value is needed.

4. Post-exploitation impact. The order is marked settled in the shop database. The merchant's fulfilment workflow (warehouse picking, shipping, digital-goods delivery) treats the order as paid and releases the goods. The attacker receives the product without paying. Secondary abuse includes settling cancelled or abandoned orders to corrupt accounting records, or repeatedly exploiting the flaw to place large numbers of unpaid orders for resale.

The absence of rate limiting or gateway-IP enforcement in the vulnerable versions means the same attack can be run repeatedly against multiple orders with minimal effort.

Impact Assessment

Business impact. The primary impact is direct revenue loss: an attacker obtains physical or digital goods without payment. Because these are pay-later methods, the merchant may not notice the discrepancy until the payment provider performs reconciliation or the bank transfer/konbini payment never arrives — by which time goods have shipped. Repeated exploitation can cause material fraud losses, especially for shops with high order volumes or automated fulfilment pipelines.

Affected systems. Any WordPress installation running the Welcart e-Commerce plugin at a version prior to 2.11.33, with convenience-store or bank-transfer settlement enabled. Sites that do not enable these pay-later methods are not exposed to this specific callback path.

Blast radius. The vulnerability is scoped (CVSS S:U). It permits modification of order state only — no database or file disclosure, no administrator access, no cross-site impact on other tenants or services. However, order-state integrity is a security boundary for payment processing; corrupting that boundary cascades to fulfilment, inventory, accounting, and customer-support operations. The CVSS Integrity subscore is Low, reflecting that the attacker cannot modify arbitrary data — only the payment status flag of orders they can enumerate or guess.

Threat landscape. No in-the-wild exploitation evidence, no CISA KEV listing, and a low EPSS score suggest this is not currently an active attack vector. That may change once the underlying patch situation is clarified and a signature is reverse-engineered from version 2.11.33.

Detection Guidance

Tuning note. At the time of writing, the exact callback URI and parameter names have not been published. The rules below therefore target the vulnerability mechanism — unauthenticated requests carrying an order identifier and a settlement/payment-complete flag — rather than a specific endpoint. SOC teams should tune the string patterns once the vendor discloses the callback route or once a diff against version 2.11.33 is available.

Sigma Rule

title: Welcart Settlement Callback Without Gateway Authentication - CVE-2026-15213
id: 9f1c63a2-8e2a-4fd4-b7ae-6c31b3d9d001
status: experimental
description: Detects unauthenticated HTTP requests matching a settlement-callback pattern (order identifier plus payment-complete flag) on hosts running the Welcart e-Commerce WordPress plugin. Tune the URI patterns to the vendor-disclosed callback path.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-15213
author: Valtersit Threat Intel
date: 2026/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection_method:
        cs-method: POST
    selection_uri:
        cs-uri-query|contains|all:
            - 'order'
            - 'settl'
    selection_status:
        cs-uri-query|contains|any:
            - 'paid'
            - 'complete'
            - 'settled'
    condition: selection_method and selection_uri and selection_status
falsepositives:
    - Legitimate payment-gateway callback traffic (exclude gateway ASN/IP ranges if known)
    - Shopping carts that include the literal words 'order' and 'settlement' in a request
level: medium
tags:
    - attack.t1190
    - cve.2026-15213

YARA Rule

rule CVE_2026_15213_Welcart_Settlement_Callback
{
    meta:
        author      = "Valtersit Threat Intel"
        description = "Detects network artifacts (PCAP, HTTP logs) consistent with the unauthenticated Welcart settlement callback described in CVE-2026-15213: order identifier plus settlement/paid flag with Welcart context."
        date        = "2026-01-01"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-15213"
        cve         = "2026-15213"
        score       = 60

    strings:
        $wc_ctx = "welcart" ascii wide nocase
        $cb     = "callback" ascii wide nocase
        $order_a = /order[_-]?(id|number|no|code)?/ ascii wide nocase
        $flag_a = /settl(e|ed|ement)?/ ascii wide nocase
        $flag_b = /paid|complete|success/ ascii wide nocase

    condition:
        uint16(0) == 0x0D0A or uint16(0) == 0x0A0D or filesize < 5MB
        and 2 of ($order_a, $flag_a, $flag_b)
        and ($wc_ctx or $cb)
}

Suricata IDS Rule

# Tune HTTP URI / query keywords to the actual callback route disclosed by the vendor.
alert http any any -> any any (msg:"ET WEB_SPECIFIC_APPS Welcart unauthenticated settlement callback attempt (CVE-2026-15213)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"callback"; nocase; pcre:"/(order|ordno|order_id|order_number)[^&\s]*&?(settl|paid|complete|success)/Ui"; classtype:attempted-admin; reference:cve,2026-15213; sid:2026152131; rev:1;)

Elastic Detection

any where event.category == "web" and
  http.request.method == "POST" and
  (url.path like "*callback*" or url.path like "*welcart*") and
  (url.query like "*order*" and
   (url.query like "*settl*" or url.query like "*paid*" or url.query like "*complete*")) and
  not source.ip in (/* add known payment-gateway CIDR ranges here */)

Splunk SPL Query

index=web sourcetype=access_combined
| rex field=_raw "(?<cb_uri>\S*(?:callback|welcart)\S*)"
| search cb_uri=*
| rex field=_raw "(?<has_order>(?i)order[_-]?(?:id|number|no)?)"
| rex field=_raw "(?<has_flag>(?i)(?:settl|paid|complete|success))"
| where isnotnull(has_order) AND isnotnull(has_flag)
| eval src_ip=coalesce(clientip, src_ip)
| stats count by src_ip, uri, status
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,accesslog,cve-2026-15213,">
  <rule id="152132" level="8">
    <decoded_as>web</decoded_as>
    <field name="method">POST</field>
    <match>callback|welcart</match>
    <regex>\S*(?:order[_-]?(?:id|number|no)?)\S*</regex>
    <regex>\S*(?:settl|paid|complete|success)\S*</regex>
    <description>Potential Welcart settlement callback abuse (CVE-2026-15213): unauthenticated order-to-paid status transition</description>
    <group>attack.t1190,cve-2026-15213,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch status. Patch confidence is 0/4 — UNPATCHED per all tracked sources. No vendor advisory, code commit, or release note was identified. The NVD description states the flaw exists "before 2.11.33", which implies the fix lands in 2.11.33, but this could not be independently verified. Treat any upgrade as unconfirmed until the vendor publishes a changelog.

Immediate mitigations (no patch available):

1. Disable convenience-store and bank-transfer pay-later methods in Welcart settings if business operations allow. This removes the vulnerable callback path entirely.
2. If these payment methods are business-critical, restrict access to the callback endpoint at the WAF/reverse proxy layer. Because the vulnerable code does not verify origin, an IP allowlist populated with the payment provider's published gateway networks is an effective compensating control — provided the provider publishes stable ranges.
3. Reconcile fulfilment to payment provider confirmations. Temporarily require manual verification of all pay-later order settlements before shipping, or set a holding period on such orders until the payment appears in the provider's dashboard.
4. Instrument monitoring. Deploy the detection rules above and alert on any settlement callback that does not originate from the payment gateway's infrastructure.

Patch / upgrade steps.

1. Verify with the vendor (https://www.welcart.com/) that version 2.11.33 contains the fix and review the official changelog.
2. Stage the upgrade on a test instance; regression-test the convenience-store and bank-transfer checkout flows end to end, including legitimate callback processing.
3. Apply the plugin update in production during a maintenance window and confirm the plugin version via the WordPress admin dashboard.

Long-term hardening.

1. After upgrading, perform negative testing: submit callbacks with wrong amounts, missing signatures, and arbitrary source IPs to confirm they are rejected.
2. Defence in depth: require API-key or HMAC verification for all server-to-server payment callbacks; enforce idempotency keys; validate that the reported amount matches the order total; reject callbacks for orders in unexpected states (e.g., already fulfilled).
3. Network segregation: place WordPress behind a managed WAF with virtual-patching capacity so this class of flaw can be blocked before a vendor patch ships.
4. Process control: separate the payment-settlement state from the fulfilment/fulfilment-release state so a single unauthenticated flag cannot drive physical shipping.
5. Add this CVE to your vulnerability-management queue with a re-check cadence, since patch evidence may surface after the report publication date.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-15213
2. Vendor site / plugin information — https://www.welcart.com/
3. FIRST EPSS Score for CVE-2026-15213 — https://www.first.org/epss/
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-15213 not currently listed) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. MITRE ATT&CK Technique T1190 — https://attack.mitre.org/techniques/T1190/

Threat-actor / in-the-wild evidence. No public exploit code, Nuclei template, or PoC was identified at the time of writing. The CVE is not in CISA KEV, has a low EPSS percentile rank, and no vendor-confirmed incident or threat-actor campaign has been reported. Organisations running Welcart below 2.11.33 should nevertheless treat this as a high-priority integrity control gap for their payment pipeline, given the trivial pre-authentication attack mechanics.