CVE-2025-10649: Welcart e-Commerce WordPress SQL Injection

CVE-2025-10649 Overview

The Welcart e-Commerce plugin for WordPress contains a SQL Injection vulnerability affecting all versions up to and including 2.11.21. The flaw resides in cookie handling, where user-supplied values are insufficiently escaped and the underlying SQL query lacks proper preparation. Authenticated attackers holding Author-level access or higher can append additional SQL statements to existing queries. This allows extraction of sensitive data from the WordPress database, including credentials, session tokens, and customer records. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated attackers with Author or higher privileges can exfiltrate arbitrary database contents by injecting SQL through a cookie value, exposing customer, order, and credential data stored by the e-commerce plugin.

Affected Products

Welcart e-Commerce plugin for WordPress, versions up to and including 2.11.21
WordPress sites running the usc-e-shop plugin package
Any deployment permitting Author-level accounts alongside Welcart

Discovery Timeline

2025-10-08 - CVE-2025-10649 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10649

Vulnerability Analysis

The vulnerability arises in the Welcart e-Commerce plugin's request handling logic, where a cookie value flows into a SQL query without adequate sanitization or use of prepared statements. Because the plugin trusts the cookie string and concatenates it into a query, an attacker controlling that cookie can break out of the intended query context. The result is a classic in-band SQL injection primitive suitable for UNION-based data extraction or stacked query techniques permitted by the underlying database driver.

Exploitation requires an authenticated session with at least Author-level privileges in WordPress. This narrows the attack surface but does not eliminate it, since multi-author WordPress deployments, guest-post workflows, and compromised low-privilege accounts frequently satisfy the requirement. Successful exploitation exposes confidentiality of the database, including wp_users hashes, session tokens, API keys stored by the plugin, and order or customer records held in Welcart tables.

Root Cause

The root cause is insufficient escaping of user-supplied input combined with the absence of parameterized query preparation via $wpdb->prepare(). The plugin reads a cookie value and interpolates it into a SQL statement. Without esc_sql() or prepared placeholders, cookie contents are interpreted as SQL syntax rather than data. The remediation in changeset 3374119 applies proper escaping and query preparation to eliminate the injection path.

Attack Vector

The attack vector is network-based over HTTP or HTTPS. An authenticated attacker sets or modifies a targeted cookie to include SQL payload fragments, then triggers a plugin action that reads and processes the cookie. The injected fragment is executed against the WordPress database with the privileges of the database user configured in wp-config.php, typically full read and write across all site tables. See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-10649

Indicators of Compromise

Unusual SQL syntax fragments such as UNION SELECT, SLEEP(, or INFORMATION_SCHEMA observed within HTTP Cookie headers in web server logs
Anomalous database query durations or errors from the WordPress database around requests to Welcart endpoints under /wp-content/plugins/usc-e-shop/
Unexpected reads against wp_users, wp_usermeta, or Welcart order tables originating from web application sessions
Author-level or higher accounts issuing requests to Welcart endpoints they have no legitimate reason to access

Detection Strategies

Deploy a web application firewall rule to flag SQL metacharacters and keywords inside inbound Cookie header values targeting usc-e-shop request paths
Enable MySQL or MariaDB general query logging or slow query logging temporarily to identify malformed queries generated by the plugin
Correlate authenticated WordPress session activity with database error rates to surface injection probing

Monitoring Recommendations

Alert on any Author-level or higher account performing sequential requests to Welcart endpoints with modified cookies
Monitor for outbound data transfer spikes from the web tier that could indicate bulk database exfiltration
Track plugin version inventory across managed WordPress installations to confirm patch adoption above 2.11.21

How to Mitigate CVE-2025-10649

Immediate Actions Required

Update the Welcart e-Commerce plugin to the version released in changeset 3374119, which is any release after 2.11.21
Audit all WordPress accounts with Author role or higher and remove or downgrade unused or stale accounts
Rotate WordPress secret keys in wp-config.php and force password resets if compromise is suspected
Review database access logs for evidence of prior exploitation attempts against Welcart endpoints

Patch Information

The vendor addressed the vulnerability in the WordPress plugin repository via changeset 3374119. The fix introduces proper input escaping and prepared statement usage for the affected cookie-derived query. Administrators should apply the update through the WordPress plugin management interface or via wp-cli using wp plugin update usc-e-shop.

Workarounds

Restrict Author-level and higher access using role management plugins until patching is complete
Deploy a web application firewall rule to strip or reject SQL metacharacters in the affected cookie name
Temporarily deactivate the Welcart plugin on sites that cannot be patched immediately
Enforce IP allow-listing on /wp-admin/ to reduce exposure of authenticated endpoints

bash

# Update the Welcart plugin using wp-cli
wp plugin update usc-e-shop

# Verify installed version is above 2.11.21
wp plugin get usc-e-shop --field=version

# List all users with Author role or higher for audit
wp user list --role=author --fields=ID,user_login,user_email,user_registered