CVE-2026-19887: CWE-502 Deserialization of Untrusted Data in uscnanbu Welcart e-Commerce

CVE-2026-19887 is a deserialization vulnerability (CWE-502) in the Welcart e-Commerce WordPress plugin (versions up to 2.12.1). The flaw arises from insecure handling of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction), allowing unauthenticated attackers to store arbitrary 'reserve' key/value pairs as order metadata during public checkout. Later, attackers can invoke the callback with a crafted 'option' parameter to unserialize this metadata without any signature, source, or ownership verification. The bundled TCPDF library contains a POP chain enabling arbitrary file deletion on the server, including wp-config.php. This can lead to remote code execution if an administrator prints an invoice (triggering file deletion) and reruns the WordPress installer against a database controlled by the attacker.

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the server, including critical configuration files like wp-config.php. This can result in remote code execution if the WordPress installer is rerun with attacker-controlled data. The vulnerability affects confidentiality, integrity, and availability of the affected system, with high impact on all three.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin's payment callback endpoint if possible and monitor for suspicious activity. Avoid rerunning the WordPress installer on compromised databases. Administrators should be cautious when printing invoices as this action triggers the file deletion exploit.