CVE-2026-111027

— UNSCORED

Published 2026-10-28 · Updated 2026-10-28

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks.

All references

https://wpscan.com/vulnerability/83de6994-0446-4944-abd5-50a0bbdf63f6/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.