CVE-2026-107752

MEDIUM CVSS 4.9
Published: 2026-10-17
Modified: 2026-10-18
Tenable Plugin

Checking the public Tenable catalog…

Threat Intelligence Pending

IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.

Description

The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON fields searchSql / searchSkuSql)' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Quick Facts
CVE ID CVE-2026-107752
CVSS Score 4.9
Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Published 2026-10-17
Exploited No
CISA KEV No
PoC Not public
References
External Resources
NVD Entry BleepingComputer The Hacker News