Welcart e-Commerce < 2.2.8 - Authenticated System Information Disclosure

Description

The usces_download_system_information AJAX action of the plugin did not have capability check in place, allowing any authenticated user (such as subscriber) to can export data including WordPress settings, theme and plugins (active/inactive) along with their version, Welcart general settings and payment method etc, as well as the server and PHP settings