Welcart e-Commerce EUVD-2026-103221

Exploitation requires an authenticated WordPress account with editor-level privileges or higher (per description and CVSS PR:H), and the attacker must reach the Welcart order-management admin functionality that processes the wp_usces_order_old request containing the searchSql / searchSkuSql JSON fields. No special non-default plugin configuration is described - any site running Welcart e-Commerce <= 2.12.4 with such an account is affected. The principal limiting factors are the elevated authentication requirement (not reachable by anonymous or low-privilege subscriber accounts) and that impact is read-only data disclosure with no integrity or availability effect; no user interaction by a victim is required.

This is a moderate, authentication-gated issue rather than an urgent priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9) confirms network reach and low attack complexity, but PR:H means the attacker must already hold an elevated WordPress role - the description specifies 'editor-level access and above,' so this is not pre-auth. Impact is confidentiality-only (C:H, I:N, A:N): the SQL injection enables reading sensitive database contents but not modification or denial of service. No EPSS score, KEV listing, POC, or SSVC decision data was supplied; absence of these is not evidence of safety but means there is no signal of active or probable exploitation. Note a mild tension worth verifying: CVSS marks PR:H, yet a WordPress 'editor' is a mid-tier role below administrator, so some scorers would rate this PR:L - either way it requires a trusted authenticated account, which substantially limits the realistic attacker population to insiders or compromised editor credentials. There are no conflicting network-vs-local signals; the network vector is consistent with a web-accessible WordPress admin endpoint.

An attacker who already holds editor-level (or higher) credentials on the WordPress site - for example a malicious insider or someone using phished/stolen editor login - opens the order list admin feature and submits a crafted value in the wp_usces_order_old JSON searchSql/searchSkuSql field. Because the parameter is insufficiently escaped and not parameterized, the injected SQL appends to the existing query and returns sensitive database rows such as customer order data. No public exploit code was identified at time of analysis, so exploitation currently requires manual crafting against the documented vulnerable parameter.