CVE-2025-47511 MEDIUM

CVE-2025-47511: WordPress Welcart e-Commerce plugin <= 2.11.13 - Arbitrary File Deletion Vulnerability

Vendor Info@Welcart
Product Welcart e-Commerce
Weakness CWE-22 · Path traversal
Published June 9, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

What the vulnerability does

01Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Path Traversal.This issue affects Welcart e-Commerce: from n/a through <= 2.11.13.

Explanation of Vulnerability in Simple Terms

02Summary

Welcart e-Commerce versions 2.11.13 and earlier contain a path traversal vulnerability that allows high-privilege users to cause a denial of service by manipulating file paths. The vulnerability requires administrative access and affects system availability across the application scope. No authentication bypass or data exposure occurs.

What an attacker can do

03Attacker Capabilities

An admin user can crash or disable the site by exploiting path traversal to access restricted files.

Potential impact on your site

04Site Impact

A malicious admin can take your site offline or degrade its availability without leaving obvious traces.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrative privileges; no user interaction required.

Key dates

06Disclosure timeline

June 9, 2025 CVE published
April 28, 2026 Record updated