CVE-2026-107752 uscnanbu CVE debrief

Who should care

Defenders responsible for WordPress installations with the Welcart e-Commerce plugin should assess exposure and verify patching to prevent potential exploitation. Editor-level access and above is required for exploitation.

Why it matters

The Welcart e-Commerce plugin for WordPress has a SQL injection vulnerability that allows authenticated attackers to extract sensitive information from the database. Defenders should assess exposure, verify patching, and monitor for exploitation attempts.

• Potential extraction of sensitive information from the database.
• Requires verification of patching to prevent exploitation.
• Medium priority for defenders due to the CVSS score and potential impact.
• Defenders should monitor for potential exploitation attempts targeting the vulnerable plugin.

Technical summary

The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON fields searchSql / searchSkuSql)' parameter in all versions up to, and including, 2.12.4. This vulnerability allows authenticated attackers, with editor-level access and above, to append additional SQL queries into existing queries, potentially leading to sensitive information extraction from the database.

Defensive priority

Medium priority for defenders to assess exposure and verify patching, given the vulnerability's medium CVSS score and potential for data extraction.

Recommended defensive actions

• Assess exposure by identifying WordPress installations with the Welcart e-Commerce plugin version 2.12.4 or earlier.
• Verify patching by updating the Welcart e-Commerce plugin to a version that addresses the SQL injection vulnerability.
• Monitor for potential exploitation attempts targeting the vulnerable plugin.
• Restrict access to the WordPress plugin and database to minimize potential impact.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the SQL injection vulnerability in the Welcart e-Commerce plugin for WordPress. The vulnerability is due to insufficient escaping on user-supplied parameters and lack of sufficient preparation on existing SQL queries.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.