A critical PHP object injection vulnerability in the Welcart e-Commerce plugin enables unauthenticated attackers to achieve remote code execution via a complex attack chain.

This vulnerability is a deserialization of untrusted data (CWE-502) affecting the Telecom EDY payment callback. Unauthenticated attackers can inject malicious serialized objects that are processed by a POP chain within the bundled TCPDF library, allowing for arbitrary file deletion and subsequent remote code execution.

The ability for an unauthenticated attacker to delete critical system files, such as wp-config.php, poses a severe risk to business continuity and data integrity. With a CVSS score of 8.8, this high-severity flaw could lead to a complete site takeover, unauthorized access to sensitive customer data, and prolonged system downtime during incident response and recovery.

Immediate Action: Update the Welcart e-Commerce plugin to version 2.12.2 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor server logs for suspicious requests directed at the usces_action_acting_transaction parameter or unusual file deletion events within the WordPress root directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious serialized PHP objects and restrict access to payment callback endpoints where possible.

Public Exploit Available: Unknown

Given the potential for remote code execution, organizations using the Welcart e-Commerce plugin must treat this vulnerability with the highest priority. Administrators should verify their current version and apply the 2.12.2 update without delay to neutralize the injection vector. If patching is not immediately feasible, consider disabling the e-commerce functionality or restricting access to the affected callback endpoint until a secure state is reached.