WordPress Plugin Vulnerabilities

Welcart e-Commerce < 2.10.0 - Missing Authorization

Description

The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the usces_item_duplicate() function in versions up to, and including, 2.9.14. This makes it possible for authenticated attackers, with author-level access and above, to duplicate other authors posts.

Affects Plugins

Plugin icon
usc-e-shop
Fixed in 2.10.0

References

CVE
CVE-2024-32144
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/61799fbc-05dc-4de9-90f9-8712ba554607

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
emad
Verified
No
WPVDB ID
531e9e8d-85b5-4bf2-8d49-88fa416ee39e

Timeline

Publicly Published
2024-04-12 (about 2 years ago)
Added
2024-04-17 (about 2 years ago)
Last Updated
2024-04-17 (about 2 years ago)

Other

Published
Title
Published
2025-01-24
Title
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress < 1.3.5 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
Published
2025-12-11
Title
Spoter for Elementor <= 1.04 - Missing Authorization
Published
2026-01-08
Title
Tutor LMS – eLearning and online course solution < 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification
Published
2024-01-08
Title
Word Replacer Pro <= 1.0 - Missing Authorization
Published
2025-07-03
Title
MF Plus WPML <= 1.1 - Missing Authorization to Unauthenticated Settings Update