Dashboard / CVE-2026-111027

CVE-2026-111027

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 59/100
Published: 2026-10-28 Modified: 2026-10-28 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
S: Changed
C: High
I: None
A: None

Description

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
Unknown Welcart e-Commerce 0 < 2.12.6

References & Advisories (1)

Bug Bounty Relevance

59 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

EPSS — Exploitation Probability

0.30%
Raw Score 0.002970
Percentile 22.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00297
2026-10-28
0.00176

Intelligence Sources

mitre ref →
nvd ref →

External Links