CVE-2025-27130

moderate-risk

Published 2025-04-01

Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker who can access websites created using the product.

Do I need to act?

0.93% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (1)

Welcart E-Commerce

Affected Vendors

Welcart

References (2)

Third Party Advisory https://jvn.jp/en/jp/JVN87266215/

Release Notes https://www.welcart.com/archives/23868.html

/ 100

moderate-risk

Severity 30/34 · Critical

Exploitability 3/34 · Minimal

Exposure 5/34 · Minimal