Live › vulnerability › CVE-2026-111027
Go to dashboardThe Welcart e-Commerce WordPress plugin before 2.12.6 passes an unescaped parameter into a SQL query and removes the escaping it had applied first. A user with the Editor role or higher can inject SQL to read or change the site database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Welcart e-Commerce WordPress plugin older than 2.12.6 that have accounts with the Editor role or higher. Sites without the plugin, or with it at 2.12.6 or later, are not affected. The sources do not say whether the flaw is reachable by lower-privilege roles.
No product ranges from the sources yet.
wp plugin get welcart-e-commerce --field=version2.12.6 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-111027")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.