EUVD-2026-53731
GHSA-xgjq-gf22-rvwq
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Editor-level credentials required for CSV import access; network-reachable admin panel; database read/write fully exposed; no availability impact described.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above (including its custom shop-management roles) to perform SQL injection attacks.
AnalysisAI
SQL injection in the Welcart e-Commerce WordPress plugin (all versions before 2.11.32) enables authenticated users holding at minimum the Editor role - or Welcart's custom shop-management roles - to execute arbitrary SQL against the underlying WordPress database by supplying a crafted CSV file through the plugin's import feature. A publicly available proof-of-concept exploit exists (reported by WPScan), meaningfully lowering the bar for abuse by any account with sufficient role access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with at minimum the Editor role or one of Welcart e-Commerce's custom shop-management roles - unauthenticated users and lower-privileged roles (Subscriber, Contributor) cannot reach the vulnerable CSV import endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 reflects genuine but bounded risk: the high-privilege requirement (PR:H - Editor role or above) significantly constrains the attacker pool relative to unauthenticated network-exploitable flaws. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained - through credential stuffing, phishing, or insider access - a WordPress account with the Editor role or a Welcart shop-management role crafts a CSV file embedding SQL injection payloads in one of the fields processed by the import routine. They upload this file through the Welcart plugin's standard CSV import interface, causing the plugin to execute attacker-controlled SQL against the WordPress database. … |
| Remediation | The primary fix is to update the Welcart e-Commerce plugin to version 2.11.32 or later, which contains the vendor-released patch addressing the unsanitized CSV input. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Welcart E Commerce
View allThe Welcart e-Commerce WordPress plugin before 2.9.5 unserializes user input from cookies, which could allow unautehtnia
Unauth. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low
The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have au
The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usc
Stored cross-site scripting in the Welcart e-Commerce WordPress plugin (all versions before 2.11.34) allows any authenti
The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on th
The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing an
The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back
The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any
Payment callback fraud in the Welcart e-Commerce WordPress plugin (versions before 2.11.33) allows any unauthenticated r
Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. Rated high seve
SQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can login to the product to obt
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today