Welcart e-Commerce CVE-2025-10649

Exploitation requires an authenticated WordPress account with Author-level capabilities or higher on a site running the Welcart e-Commerce plugin at version 2.11.21 or earlier; the attacker injects via a user-supplied cookie value that the plugin fails to escape or parameterize. Limiting factors: the PR:L requirement means a self-registered subscriber cannot exploit it directly - the attacker needs at least Author role, so sites that do not grant Author to untrusted users, or that restrict registration, meaningfully reduce exposure. Impact is limited to database read/confidentiality; no integrity or availability impact and no user interaction is needed. Risk rises sharply on multi-author or open-registration sites where Author accounts are easily acquired.

This is a moderate-risk, authenticated SQL injection (CWE-89) rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates network-reachable, low-complexity exploitation with no user interaction, but critically requires PR:L - Author-level access or above - which substantially limits the attacker population to users who already hold a privileged content role. Impact is confined to confidentiality (C:H, I:N, A:N): data extraction, not data tampering or denial of service. The EPSS score of 0.28% (18th percentile) reflects low predicted near-term exploitation probability, and there is no CISA KEV listing and no public proof-of-concept referenced, yielding exploitation status: no public exploit identified at time of analysis. These signals are mutually consistent - no conflict - pointing to a genuine but not widely-weaponized flaw. The main caveat is the privilege prerequisite: on WordPress sites where Author accounts are freely self-registered or loosely governed (e.g. multi-author or membership sites), the PR:L barrier is weaker than it appears, raising practical risk; on tightly-controlled single-admin stores it is low. Net: patch promptly but it is not a drop-everything issue absent active-exploitation evidence.

An attacker who holds (or obtains) an Author-level or higher account on a WordPress site running Welcart e-Commerce ≤2.11.21 sends a request with a maliciously crafted cookie value that is concatenated into an existing, insufficiently-prepared SQL query, appending attacker-controlled SQL. Because AC:L and UI:N, the injection succeeds reliably without special timing or victim interaction, letting the attacker read sensitive database contents such as customer records and credentials. No public exploit code is identified at time of analysis, so exploitation would require the attacker to develop the payload independently.