CVE-2025-15671: CWE-287 Improper Authentication in Welcart e-Commerce

The Welcart e-Commerce WordPress plugin prior to version 2.12.1 contains a session fixation vulnerability due to improper authentication handling (CWE-287). Specifically, the plugin does not regenerate the session identifier upon user authentication and accepts the session ID from a user-supplied request parameter. An attacker can exploit this by forcing a victim to use a session ID controlled by the attacker, allowing the attacker to hijack the victim's session and gain unauthorized access to their customer account after login.

An attacker can fixate a session identifier for a victim and take over the victim's customer account after the victim logs in. This leads to unauthorized access to the victim's account, potentially exposing personal and transactional information. The CVSS score is 5.4 (medium severity), indicating limited but meaningful confidentiality and integrity impact without availability impact.

A fixed version 2.12.1 or later is available that addresses this vulnerability by properly regenerating session identifiers on authentication and disallowing session ID setting from user-supplied parameters. Users should upgrade to Welcart e-Commerce version 2.12.1 or later to remediate this issue.