CVE-2021-4375: Welcart E-Commerce

Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days.

The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the usces_download_system_information() function in versions up to, and including, 2.2.7. This makes it possible for authenticated attackers to download information including WordPress settings, plugin settings, PHP settings and server settings.

Affected products

• Welcart Welcart E-Commerce: up to and including 2.2.7

Published 2023-06-07. Last modified 2026-06-17.