CVE-2026-111027 in Welcart E-Commerce Plugin

Sumário

de MITRE • 28/10/2026

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

• Responsável: WPScan
• Reservar: 15/10/2026
• Divulgação: 28/10/2026
• Moderação: aceite
• Entrada: VDB-427706
• CPE: 20261028
• CWE: CWE-89 (confirmado)
• CVSS: 4.7 (VulDB)
• EPSS: 0.00000
• KEV: não
• Atividades: muito baixo
• Sector: Hostingprovider

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-111027
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111027
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-111027/