{"id":"CVE-2026-111027","kind":"vulnerability","aliases":["CVE-2026-111027"],"related":[],"title":"Welcart e-Commerce WordPress plugin: SQL injection by Editor-role users","description":"The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks.","summary":"The Welcart e-Commerce WordPress plugin before 2.12.6 passes an unescaped parameter into a SQL query and removes the escaping it had applied first. A user with the Editor role or higher can inject SQL to read or change the site database.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","welcart-e-commerce","wordpress"],"not_affected_if":["no-editor-role-users","plugin-at-2.12.6-or-later"],"how_to_check":"- Check the installed Welcart e-Commerce plugin version in the WordPress admin under Plugins, or with `wp plugin get welcart-e-commerce --field=version`\n- Review which accounts hold the Editor role or higher","fix":"- Update the Welcart e-Commerce plugin to `2.12.6` or later\n- Review Editor and Author accounts for anything unexpected until the update is applied","status":"open","published_at":"2026-10-28T06:16:34+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","triaged_at":"2026-10-28T06:32:38+00:00","updated_at":"2026-10-28T06:32:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T06:32:38Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Welcart e-Commerce plugin to `2.12.6` or later\n- Review Editor and Author accounts for anything unexpected until the update is applied","reach":"internet","title":"Welcart e-Commerce WordPress plugin: SQL injection by Editor-role users","impact":"high","summary":"The Welcart e-Commerce WordPress plugin before 2.12.6 passes an unescaped parameter into a SQL query and removes the escaping it had applied first. A user with the Editor role or higher can inject SQL to read or change the site database.","category":"package","nicknames":[],"who_cares":["wordpress","welcart-e-commerce","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with Editor account reads or alters the WordPress database","analyst_note":"","how_to_check":"- Check the installed Welcart e-Commerce plugin version in the WordPress admin under Plugins, or with `wp plugin get welcart-e-commerce --field=version`\n- Review which accounts hold the Editor role or higher","needs_analyst":false,"not_affected_if":["plugin-at-2.12.6-or-later","no-editor-role-users"],"who_is_affected":"Sites running the Welcart e-Commerce WordPress plugin older than 2.12.6 that have accounts with the Editor role or higher. Sites without the plugin, or with it at 2.12.6 or later, are not affected. The sources do not say whether the flaw is reachable by lower-privilege roles.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000613,"input_tokens":3308,"output_tokens":564,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111027':16A,19A '-2026':15A,18A '2.12.6':37B,80C 'allow':107C 'appli':52B,102C 'attack':119C 'chang':68B 'commerc':4A,27B,33B,76C 'cve':14A,17A 'databas':71B 'e':3A,26B,32B,75C 'e-commerc':2A,31B,74C 'editor':11A,58B,111C 'editor-rol':10A 'escap':49B,86C,99C 'first':53B 'higher':61B,114C 'host':23B 'inject':8A,63B,118C 'packag':20B 'paramet':41B,88C 'pass':38B 'perform':116C 'plugin':6A,35B,78C 'proper':83C 'queri':45B,95C,106C 'read':66B 'remov':47B 'role':12A,59B,112C 'run':104C 'sanitis':84C 'self':22B 'self-host':21B 'site':70B 'sql':7A,44B,64B,94C,117C 'strip':97C 'unescap':40B 'use':90C 'user':13A,55B,108C 'welcart':1A,25B,30B,73C 'welcart-e-commerc':24B 'wordpress':5A,28B,34B,77C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Welcart e-Commerce WordPress plugin older than 2.12.6 that have accounts with the Editor role or higher. Sites without the plugin, or with it at 2.12.6 or later, are not affected. The sources do not say whether the flaw is reachable by lower-privilege roles.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111027","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111027","severity":null,"published_at":"2026-10-28T06:16:34+00:00","modified_at":"2026-10-28T06:16:34+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","fetched_at":"2026-10-28T06:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}