What is the CVSS score of CVE-2026-16065?

CVE-2026-16065 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-16065?

Yes, a public proof-of-concept exploit is available for CVE-2026-16065. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-16065?

Yes, a patch is available for CVE-2026-16065. Update the affected software to the latest version immediately.

Welcart e-Commerce CVE-2026-16065

EUVD-2026-53731 MEDIUM

SQL Injection (CWE-89)

2026-08-06 WPScan

GHSA-xgjq-gf22-rvwq

WordPress SQLi Welcart E Commerce Unknown

6.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.5 MEDIUM

Editor-level credentials required for CSV import access; network-reachable admin panel; database read/write fully exposed; no availability impact described.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 13:27 vuln.today

CVSS changed

Aug 06, 2026 - 13:22 NVD

6.5 (MEDIUM)

Patch available

Aug 06, 2026 - 07:02 EUVD

CVE Published

Aug 06, 2026 - 06:00 cve.org

MEDIUM 6.5

CVE Published

Aug 06, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above (including its custom shop-management roles) to perform SQL injection attacks.

AnalysisAI

SQL injection in the Welcart e-Commerce WordPress plugin (all versions before 2.11.32) enables authenticated users holding at minimum the Editor role - or Welcart's custom shop-management roles - to execute arbitrary SQL against the underlying WordPress database by supplying a crafted CSV file through the plugin's import feature. A publicly available proof-of-concept exploit exists (reported by WPScan), meaningfully lowering the bar for abuse by any account with sufficient role access. No active exploitation is confirmed in CISA KEV at time of analysis, but the combination of a public POC and high database impact (confidentiality and integrity both rated High) makes patching urgent for multi-editor or multi-manager WordPress deployments.

Technical ContextAI

The vulnerable component is the Welcart e-Commerce WordPress plugin (CPE: cpe:2.3:a:unknown:welcart_e-commerce:*:*:*:*:*:*:*:*), a WooCommerce-adjacent e-commerce solution. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): a value extracted from a user-supplied CSV import file is concatenated or interpolated into a SQL query without proper sanitization or the use of parameterized prepared statements. WordPress plugins typically interact with the database through the wpdb abstraction layer, and failure to use wpdb::prepare() or equivalent escaping routines on externally-supplied input is the canonical CWE-89 pattern in this ecosystem. The CSV import pathway is a standard administrative feature of e-commerce plugins used to bulk-load product or order data, and it directly controls data that reaches the database query.

RemediationAI

The primary fix is to update the Welcart e-Commerce plugin to version 2.11.32 or later, which contains the vendor-released patch addressing the unsanitized CSV input. This is confirmed available per the WPScan advisory (https://wpscan.com/vulnerability/6b7eb3b3-40fc-41de-b7c8-ce955700c02e/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-16065). If immediate patching is blocked by operational constraints, the most effective compensating control is to restrict the CSV import capability to Administrator-level accounts only, revoking access for Editor-role and shop-management-role users - note this disables legitimate bulk-import workflows for those roles. Additionally, auditing recent CSV import activity and database logs for anomalous SQL patterns is advisable if the window of exposure was extended. No workarounds eliminate the underlying SQL injection; role restriction only reduces the attacker pool.