Welcart e-Commerce EUVD-2026-111716

Requires an authenticated WordPress user holding the Editor role or higher on a site running Welcart e-Commerce before version 2.12.6; the flaw is reached by supplying attacker-controlled input to a parameter that the plugin sanitises and escapes but then strips the escaping from before executing the SQL query. The specific parameter and request path are not named in the available sources. Limiting factors that reduce real-world risk: exploitation is impossible for anonymous or low-privilege (Subscriber/Customer) users, so the attacker must already possess or compromise a trusted Editor+ account, confining the threat largely to malicious insiders or hijacked privileged accounts; only versions prior to 2.12.6 are affected.

This is a medium-severity, authenticated SQL injection (CWE-89) whose real-world urgency is tempered by several converging signals. The input CVSS of 6.8 is driven largely by S:C (scope change) and PR:H; the EPSS score is very low at 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis - all indicating this is not a mass-exploitation target. The vuln.today decision label is 'this_month' (routine prioritisation), not act_now or emergency, which is consistent with the low EPSS and absence of KEV. The key limiting factor is the privilege requirement: the description states exploitation requires the Editor role or higher, so this is reachable only by already-trusted, authenticated users (or an attacker who has compromised such an account), not anonymous internet attackers. Impact is confidentiality-only (C:H, I:N, A:N), meaning database read/exfiltration rather than site takeover. Two signals conflict with the supplied vector and should be verified: (1) the description's 'Editor role or higher' describes an elevated but non-administrative WordPress role, whereas the supplied vector encodes PR:H - strict CVSS 3.1 would more defensibly treat an Editor as PR:L, which lowers the score; (2) S:C is debatable, since the WordPress database shares the same security authority as the vulnerable plugin. Net: a genuine but lower-tier priority - patch within a normal maintenance cycle; it is not an emergency given the privilege barrier and low exploitation probability.

An attacker who already holds (or has compromised, e.g. via credential reuse or phishing) a WordPress account with the Editor role or higher sends a crafted request to the vulnerable Welcart parameter; because the plugin strips the escaping it had applied before running the query, the attacker's input is interpreted as SQL and executed against the site database, enabling extraction of sensitive data such as user records and password hashes. No public exploit code was identified; a WPScan advisory reference exists but is not verified working exploit code. The exact vulnerable parameter and trigger are not described in the available sources.