VulnSocial

CVE-2025-15671Disclosure

LOWCVSS 5.4 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-287

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • 3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-08-21: 3Patch / Workaround · 2026-08-21: 1Technical Details · 2026-08-21: 308-21
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Full discourse3 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2025-15671 The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplie… https://www.cve.org/CVERecord?id=CVE-2025-15671 ----- Traducción: CVE-2025-15671 El … http://infoflow.cloud`

    Post summary

    The post announces CVE‑2025‑15671 for the Welcart e‑Commerce WordPress plugin, describing a session‑fixation vulnerability but providing no PoC, exploit code, remediation, or evidence of active exploitation.

    0001031
    102 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2025-15671 Session Fixation Vulnerability in Welcart e-Commerce WordPress Plugin Before 2.12.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-15671

    Post summary

    A session fixation vulnerability (CVE‑2025‑15671) impacting Welcart e‑commerce WordPress plugin versions earlier than 2.12.1 has been publicly disclosed, but no PoC, exploit, or patch information is included in the text.

    00000119
    4.1K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2025-15671 The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplie… https://www.cve.org/CVERecord?id=CVE-2025-15671

    Post summary

    The post describes the Welcart e‑Commerce WordPress plugin vulnerability where session identifiers are not regenerated upon login, possibly enabling session fixation. The issue is noted as fixed in version 2.12.1, with no PoC, exploit, or active exploitation reported.

    00000645
    58.0K followersView on X

Explore more

Back to dashboard