Unscored severity · published Oct 28, 2026
CVE-2026-111027
Welcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' Parameter
New
–
CVSS
–
EPSS
No
On KEV
Description
The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Welcart e-Commerce ·
before 2.12.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111027
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111027
exploit
https://wpscan.com/vulnerability/83de6994-0446-4944-abd5-50a0bbdf63f6/
More from Welcart e-Commerce
6.5
CVE-2026-16065
Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import
5.4
CVE-2025-15671
Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter
5.4
CVE-2026-16066
Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name
5.3
CVE-2026-15213
Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback
–
CVE-2026-111032
Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax