CVE-2025-54012 describes a deserialization of untrusted data vulnerability in Welcart e-Commerce (up to version 2.11.16). The flaw allows an attacker with high privileges to inject objects during the deserialization process, potentially leading to full compromise of the system's confidentiality, integrity, and availability. The vulnerability is network exploitable with low attack complexity and does not require user interaction. No patch or official remediation details are provided in the available data.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary code or manipulate application logic through object injection, resulting in complete compromise of confidentiality, integrity, and availability of the affected system. The CVSS vector indicates network attack vector, low complexity, high privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should monitor Welcart e-Commerce vendor communications for updates. Until a fix is available, restrict high-privilege access to the application and review deserialization usage in the application code if possible.