CVE-2026-107752: Welcart e-Commerce SQL Injection Flaw

CVE-2026-107752 is a SQL injection vulnerability in Welcart e-Commerce plugin for WordPress that enables authenticated attackers with editor-level access to extract sensitive database information. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-107752 Overview

CVE-2026-107752 is an authenticated SQL Injection vulnerability in the Welcart e-Commerce plugin for WordPress. The flaw affects all versions up to and including 2.12.4. It resides in the wp_usces_order_old handling path, specifically within the JSON fields searchSql and searchSkuSql processed by the orderList.class.php component. The plugin fails to escape user-supplied input and does not use prepared statements for the affected queries. Attackers with editor-level access or higher can append arbitrary SQL to existing queries and extract sensitive data from the WordPress database. The vulnerability is categorized under CWE-89: SQL Injection.

Critical Impact
Authenticated editors or administrators can exfiltrate arbitrary database contents, including WordPress user credentials, session tokens, and customer order data stored by the e-commerce plugin.

Affected Products

Welcart e-Commerce plugin for WordPress, all versions through 2.12.4
WordPress sites running the vulnerable usc-e-shop plugin
Patched in the release associated with Plugin Changeset #3743211

Discovery Timeline

2026-10-17 - CVE-2026-107752 published to the National Vulnerability Database
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-107752

Vulnerability Analysis

The vulnerability exists in the OrderList class of the Welcart e-Commerce plugin (classes/orderList.class.php). The affected code paths at lines 256, 473, 613, 622, and 776 concatenate user-controlled JSON values directly into SQL statements. The attacker-controlled fields searchSql and searchSkuSql are consumed inside the wp_usces_order_old handler without escaping or parameterization.

Exploitation requires editor-level privileges or higher, which limits the pool of potential attackers but is still reachable through compromised staff accounts, phishing, or privilege escalation chains. Successful injection enables data exfiltration using classic UNION-based or boolean-based techniques against the wp_users, wp_usermeta, and Welcart order tables. The impact is restricted to confidentiality; integrity and availability metrics are rated none in the published CVSS vector.

Root Cause

The root cause is a combination of insufficient escaping of user-supplied parameters and absence of prepared statements. The plugin trusts JSON-encoded search filters sent from the admin UI and inlines them into dynamic SQL. The patch in Changeset #3743211 rewrites the vulnerable query construction in orderList.class.php.

Attack Vector

The attack is network-reachable through the WordPress admin interface. An authenticated user with editor or administrator role submits a crafted request containing malicious SQL within the searchSql or searchSkuSql JSON fields consumed by wp_usces_order_old. The injected payload executes with the database privileges of the WordPress DB_USER. See the vulnerable sinks referenced in the OrderList Class Code at Line 256 and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-107752

Indicators of Compromise

POST requests to admin.php or admin-ajax.php referencing the wp_usces_order_old action with unusually long or encoded searchSql / searchSkuSql JSON values.
Database query logs containing UNION SELECT, SLEEP(, BENCHMARK(, or information_schema references originating from the Welcart order list handler.
Unexpected reads from wp_users or wp_usermeta by the web application database account outside normal authentication flows.

Detection Strategies

Enable MySQL / MariaDB general query logging on staging and audit for malformed WHERE clauses tied to Welcart search parameters.
Deploy a WordPress-aware WAF ruleset that inspects JSON request bodies for SQL metacharacters within searchSql and searchSkuSql.
Correlate editor-level session activity with spikes in admin-ajax traffic, particularly outside business hours.

Monitoring Recommendations

Alert on any WordPress editor or administrator account issuing requests to Welcart order list endpoints that return oversized response payloads.
Track plugin version inventory across managed WordPress sites and flag any installation of usc-e-shop at version 2.12.4 or earlier.
Monitor newly created or privilege-escalated WordPress accounts, as attackers may provision editor-level users as a staging step.

How to Mitigate CVE-2026-107752

Immediate Actions Required

Upgrade the Welcart e-Commerce plugin to the version containing Changeset #3743211, which is the first release above 2.12.4.
Audit all WordPress accounts with editor-level or higher privileges and remove or rotate credentials for any that are not actively required.
Review database query logs for the past 30 days for signs of SQL injection against the Welcart order list.

Patch Information

The vendor fixed the issue in the release associated with WordPress Plugin Changeset #3743211. The patched orderList.class.php properly parameterizes the search queries. Administrators should apply the plugin update through the WordPress dashboard or by replacing the usc-e-shop directory in wp-content/plugins/.

Workarounds

Restrict access to wp-admin by source IP using web server rules or a reverse proxy until the plugin can be updated.
Enforce multi-factor authentication for all editor and administrator accounts to reduce the likelihood of credential-based abuse.
Temporarily deactivate the Welcart e-Commerce plugin on sites where the order list functionality is not business-critical.

bash

# Example: block the plugin via wp-cli until patched
wp plugin deactivate usc-e-shop
wp plugin status usc-e-shop