CVE-2026-16065: Welcart e-Commerce WordPress SQL Injection

CVE-2026-16065 Overview

CVE-2026-16065 is an authenticated SQL injection vulnerability in the Welcart e-Commerce WordPress plugin. Versions prior to 2.11.32 fail to sanitize a value read from an imported CSV file before using it in a SQL statement. Users with the Editor role or higher, including the plugin's custom shop-management roles, can inject arbitrary SQL through crafted CSV data.

The flaw allows attackers with legitimate elevated access to read, modify, or exfiltrate data from the WordPress database. This includes user credentials, session tokens, and stored customer order information.

Critical Impact
Authenticated users at Editor level or above can execute arbitrary SQL queries against the WordPress database by uploading a malicious CSV file to the Welcart e-Commerce plugin.

Affected Products

Welcart e-Commerce WordPress plugin versions before 2.11.32
WordPress installations with Editor role assignments to untrusted users
WordPress installations using Welcart custom shop-management roles

Discovery Timeline

2026-08-06 - CVE-2026-16065 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-16065

Vulnerability Analysis

The Welcart e-Commerce plugin provides CSV import functionality for bulk product and order management. The import handler reads user-supplied values from CSV rows and concatenates them into SQL statements without applying prepared statements or escaping routines such as wpdb::prepare() or esc_sql().

An attacker with Editor privileges, or any of the plugin's custom shop-management roles, uploads a CSV file containing SQL metacharacters in a targeted column. The plugin embeds the tainted value directly into a query and executes it against the WordPress database. This maps to SQL Injection under CWE-89.

The vulnerability requires authentication but does not require administrator privileges. Multi-author WordPress deployments and e-commerce sites that delegate order management to staff are the primary risk profile.

Root Cause

The root cause is missing input sanitization on a value parsed from an imported CSV file. The plugin trusts CSV field contents as internal data and omits parameterized query construction before executing SQL against the database.

Attack Vector

An authenticated attacker crafts a CSV file containing SQL syntax in a field consumed by the vulnerable importer. The attacker uploads the file through the plugin's import interface. The server parses the file, injects the tainted value into a query, and returns query results or side effects to the attacker.

For technical details on the affected parameter and injection path, see the WPScan Vulnerability Report.

Detection Methods for CVE-2026-16065

Indicators of Compromise

CSV files uploaded to the Welcart import endpoint containing SQL keywords such as UNION SELECT, SLEEP(, INTO OUTFILE, or stacked query separators
Unexpected wp_users or wp_usermeta read patterns originating from PHP-FPM workers handling Welcart import requests
New administrator accounts or modified user_pass hashes following CSV import events
Anomalous outbound database queries logged near the timestamp of a plugin import action

Detection Strategies

Enable MySQL general query log or slow query log and search for queries originating from Welcart import handlers containing quote characters and SQL control keywords in unexpected columns
Inspect WordPress access logs for POST requests to Welcart CSV import endpoints from Editor-level accounts
Correlate plugin import events with database write operations against sensitive tables such as wp_users, wp_options, and wp_usermeta

Monitoring Recommendations

Alert on any CSV upload to Welcart import handlers that contains characters such as ', --, ;, or /* in product identifier or SKU columns
Monitor for privilege changes and new user creation events within 24 hours of any Welcart import action
Track version numbers of installed WordPress plugins and flag Welcart installations running below 2.11.32

How to Mitigate CVE-2026-16065

Immediate Actions Required

Update the Welcart e-Commerce plugin to version 2.11.32 or later on all WordPress sites
Audit WordPress user accounts holding the Editor role or Welcart custom shop-management roles and remove unnecessary assignments
Review CSV import logs and database audit trails for signs of prior exploitation
Rotate WordPress administrator passwords and secret keys defined in wp-config.php if compromise is suspected

Patch Information

The vendor released a fix in Welcart e-Commerce version 2.11.32. Site operators should apply the update through the WordPress plugin management interface or via WP-CLI. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily restrict CSV import functionality to trusted administrator accounts only by revoking Editor and shop-management role assignments
Deploy a Web Application Firewall (WAF) rule that inspects file uploads to Welcart import endpoints and blocks CSV payloads containing SQL metacharacters
Place the WordPress database user under least-privilege configuration so it cannot access tables outside the WordPress schema

bash

# Update Welcart e-Commerce plugin via WP-CLI
wp plugin update usc-e-shop --version=2.11.32

# Verify installed version
wp plugin get usc-e-shop --field=version

# List users holding Editor or higher privileges for review
wp user list --role=editor --fields=ID,user_login,user_email