CVE-2022-41840: Welcart E-Commerce

Critical severity, CVSS 9.8. EPSS: 5.5% chance of exploitation in the next 30 days.

Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress.

Affected products

• Welcart Welcart E-Commerce: before 2.7.8 (fixed in 2.7.8)

Published 2022-11-18. Last modified 2026-06-17.