CVE-2021-4355: Welcart E-Commerce

Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days.

The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the download_orderdetail_list(), change_orderlist(), and download_member_list() functions called via admin_init hooks in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to download lists of members, products and orders.

Affected products

• Welcart Welcart E-Commerce: up to and including 2.2.7

Published 2023-06-07. Last modified 2026-06-17.