CVE-2026-111027
Last modified
CVE-2026-111027 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks.. EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Welcart e-Commerce | < 2.12.6 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-111027?
How severe is CVE-2026-111027?
How do I fix CVE-2026-111027?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-110985A Kafka broker using SASL/OAUTHBEARER with the default valid…
- CVE-2026-1110A flaw has been found in cijliu librtsp up to 2ec1a81ad65280…7.8
- CVE-2026-11100Use after free in File Input in Google Chrome on Mac prior t…9.6
- CVE-2026-11101Uninitialized Use in Dawn in Google Chrome on Windows prior …6.5
- CVE-2026-11102Inappropriate implementation in Isolated Web Apps in Google …8.8
- CVE-2026-111021The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress…7.1
- CVE-2026-11103Inappropriate implementation in Installer in Google Chrome o…7.8
- CVE-2026-111031The Welcart e-Commerce WordPress plugin before 2.12.6 does n…4.7
- CVE-2026-111032The Welcart e-Commerce WordPress plugin before 2.12.6 does n…3.8
- CVE-2026-111036Server-side request forgery (SSRF) vulnerability in the Coup…8.4
- CVE-2026-111037A reflected Cross-Site Scripting (XSS) vulnerability in the …5.1
- CVE-2026-111038CSV formula injection vulnerability in the export functional…7.3
Are you affected by CVE-2026-111027?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST