---
id: "CVE-2026-111032"
kind: "vulnerability"
aliases: ["CVE-2026-111032"]
title: "Welcart e-Commerce WordPress plugin lets authors alter other products' SKUs"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["e-commerce", "package", "self-hosted", "woocommerce-alternatives", "wordpress"]
not_affected_if: ["no-author-level-users", "plugin-version-2.12.6-or-later"]
published_at: "2026-10-28T06:16:34+00:00"
first_seen_at: "2026-10-28T06:31:27+00:00"
updated_at: "2026-10-28T06:32:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111032", "first_seen_at": "2026-10-28T06:31:27+00:00"}]
---

# Welcart e-Commerce WordPress plugin lets authors alter other products' SKUs

The Welcart e-Commerce WordPress plugin before 2.12.6 fails to check that a user may edit the specific product whose SKU data is being changed. Any logged-in user with Author role or higher can read, change, create, delete and reorder SKU data, including prices, confidential cost prices and stock levels, for any product.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Welcart e-Commerce plugin version in the WordPress admin Plugins screen or `wp plugin get welcart-e-commerce --field=version` and confirm it is below `2.12.6`.
- Review which accounts hold Author, Editor or higher roles on sites running Welcart.

## Fix

- Update the Welcart e-Commerce plugin to `2.12.6` or later.
- Until updated, remove Author-level or higher access from accounts that do not need it.

## Timeline

- 2026-10-28T06:31:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111032

## From the sources

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with Author-level access or higher to read, modify, create, delete and re-order the SKU data (including prices, confidential cost prices and stock levels) of any product, including those belonging to other users.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_