Live › vulnerability › CVE-2026-111032
Go to dashboardThe Welcart e-Commerce WordPress plugin before 2.12.6 fails to check that a user may edit the specific product whose SKU data is being changed. Any logged-in user with Author role or higher can read, change, create, delete and reorder SKU data, including prices, confidential cost prices and stock levels, for any product.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Welcart e-Commerce WordPress plugin before 2.12.6 that have users with Author role or higher, especially multi-author stores where some authors should not see other products' cost data. Sites with only administrators and subscribers or customers are less exposed, though an update is still advised.
No product ranges from the sources yet.
wp plugin get welcart-e-commerce --field=version and confirm it is below 2.12.6.2.12.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with Author-level access or higher to read, modify, create, delete and re-order the SKU data (including prices, confidential cost prices and stock levels) of any product, including those belonging to other users.
This page as .md · .json · in your agent: get_signal("CVE-2026-111032")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.