CVE-2026-15213

Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback

The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying.

We have discovered 6,367 live websites that are affected by CVE-2026-15213.

Run a Free Instant Scan



Affected Software

Product  Welcart
Category Ecommerce
Vulnerable Domains6,367 live websites (100% of Welcart install base)
Vulnerable Versions
  • from 0 through 2.11.33
Vulnerable Versions Count192 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-345 Insufficient Verification of Data Authenticity



Details

  • Published - Aug 12, 2026
  • Updated - Aug 12, 2026

Credits

  • Pedro Pinho (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-15213
United States135 websites


Japan5,898 websites
GB6 websites
China5 websites
Canada3 websites
Spain3 websites
Australia2 websites
Germany2 websites
Italy2 websites

Website Distribution by TLD

Number of websites using CVE-2026-15213
.com3,251 websites
.jp1,355 websites
.co.jp827 websites
.net465 websites
.info73 websites
.org68 websites
.co5 websites
.it3 websites
.be2 websites
.com.au2 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-15213

Top websites that are affected by CVE-2026-15213. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*******.jp Japan**,***
*******.com United States**,***
*********.com ***,***
********.net Japan***,***
************.com ***,***
*****.**.jp Japan***,***
*****************.com Japan***,***
*********.jp Japan***,***
************.**.jp Japan***,***
******.**.jp Japan***,***
See full domain list

FAQ

CVE-2026-15213 is Insufficient Verification of Data Authenticity in Welcart
A total of 6,367 websites have been identified as vulnerable to CVE-2026-15213, based on global website indexing conducted by WebTechSurvey.
The Welcart is affected by the CVE-2026-15213 vulnerability.
Welcart versions up to 2.11.33 are vulnerable to CVE-2026-15213.
CVE-2026-15213 is resolved in version 2.11.33 of Welcart.