{"id":"CVE-2026-111032","kind":"vulnerability","aliases":["CVE-2026-111032"],"related":[],"title":"Welcart e-Commerce WordPress plugin lets authors alter other products' SKUs","description":"The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with Author-level access or higher to read, modify, create, delete and re-order the SKU data (including prices, confidential cost prices and stock levels) of any product, including those belonging to other users.","summary":"The Welcart e-Commerce WordPress plugin before 2.12.6 fails to check that a user may edit the specific product whose SKU data is being changed. Any logged-in user with Author role or higher can read, change, create, delete and reorder SKU data, including prices, confidential cost prices and stock levels, for any product.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","package","self-hosted","woocommerce-alternatives","wordpress"],"not_affected_if":["no-author-level-users","plugin-version-2.12.6-or-later"],"how_to_check":"- Check the installed Welcart e-Commerce plugin version in the WordPress admin Plugins screen or `wp plugin get welcart-e-commerce --field=version` and confirm it is below `2.12.6`.\n- Review which accounts hold Author, Editor or higher roles on sites running Welcart.","fix":"- Update the Welcart e-Commerce plugin to `2.12.6` or later.\n- Until updated, remove Author-level or higher access from accounts that do not need it.","status":"open","published_at":"2026-10-28T06:16:34+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","triaged_at":"2026-10-28T06:32:37+00:00","updated_at":"2026-10-28T06:32:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T06:32:37Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Welcart e-Commerce plugin to `2.12.6` or later.\n- Until updated, remove Author-level or higher access from accounts that do not need it.","reach":"internet","title":"Welcart e-Commerce WordPress plugin lets authors alter other products' SKUs","impact":"medium","summary":"The Welcart e-Commerce WordPress plugin before 2.12.6 fails to check that a user may edit the specific product whose SKU data is being changed. Any logged-in user with Author role or higher can read, change, create, delete and reorder SKU data, including prices, confidential cost prices and stock levels, for any product.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce-alternatives","e-commerce","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Any author can read and alter all products' prices, cost prices and stock.","analyst_note":"","how_to_check":"- Check the installed Welcart e-Commerce plugin version in the WordPress admin Plugins screen or `wp plugin get welcart-e-commerce --field=version` and confirm it is below `2.12.6`.\n- Review which accounts hold Author, Editor or higher roles on sites running Welcart.","needs_analyst":false,"not_affected_if":["plugin-version-2.12.6-or-later","no-author-level-users"],"who_is_affected":"Sites running the Welcart e-Commerce WordPress plugin before 2.12.6 that have users with Author role or higher, especially multi-author stores where some authors should not see other products' cost data. Sites with only administrators and subscribers or customers are less exposed, though an update is still advised.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000643,"input_tokens":3347,"output_tokens":616,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111032':15A,18A '-2026':14A,17A '2.12.6':38B,94C 'access':128C 'allow':120C 'alter':9A 'altern':28B 'authent':122C 'author':8A,62B,99C,126C 'author-level':125C 'belong':156C 'capabl':110C 'chang':55B,68B,107C 'check':41B,111C 'commerc':4A,21B,34B,90C 'confidenti':77B,145C 'cost':78B,146C 'creat':69B,134C 'cve':13A,16A 'data':52B,74B,142C 'delet':70B,135C 'e':3A,20B,33B,89C 'e-commerc':2A,19B,32B,88C 'edit':46B,119C 'fail':39B 'higher':65B,130C 'host':25B 'includ':75B,143C,154C 'let':7A 'level':82B,127C,150C 'log':58B 'logged-in':57B 'may':45B 'modifi':133C 'order':139C 'packag':22B 'plugin':6A,36B,92C 'price':76B,79B,144C,147C 'process':105C 'product':11A,49B,85B,103C,117C,153C 'proper':97C 're':138C 're-ord':137C 'read':67B,132C 'reorder':72B 'role':63B 'self':24B 'self-host':23B 'sku':51B,73B,106C,141C 'skus':12A 'specif':48B 'stock':81B,149C 'target':102C 'tie':114C 'user':44B,60B,123C,159C 'verifi':98C 'welcart':1A,31B,87C 'whose':50B 'woocommerc':27B 'woocommerce-altern':26B 'wordpress':5A,29B,35B,91C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Welcart e-Commerce WordPress plugin before 2.12.6 that have users with Author role or higher, especially multi-author stores where some authors should not see other products' cost data. Sites with only administrators and subscribers or customers are less exposed, though an update is still advised.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111032","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111032","severity":null,"published_at":"2026-10-28T06:16:34+00:00","modified_at":"2026-10-28T06:16:34+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","fetched_at":"2026-10-28T06:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}