VYPR
← All advisories
High severity7.5NVD Advisory· Published Jun 7, 2023· Updated Apr 8, 2026

CVE-2021-4355

CVE-2021-4355

Description

The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the download_orderdetail_list(), change_orderlist(), and download_member_list() functions called via admin_init hooks in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to download lists of members, products and orders.

Affected products

1
  • Welcart/E Commerce
    cpe:2.3:a:welcart:welcart_e-commerce:*:*:*:*:*:wordpress:*:*
    Range: <=2.2.7

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

2

News mentions

0

No linked articles in our index yet.