CVE-2026-111032: falha de baixa gravidade em Welcart e-Commerce
Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 3.8epss 0.2%
The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with Author-level access or higher to read, modify, create, delete and re-order the SKU data (including prices, confidential cost prices and stock levels) of any product, including those belonging to other users.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
Unknown · Welcart e-CommercePoCs públicas encontradas — 1
cve_referencewpscan.com/vulnerability/73a9a609-b647-4872-96d3-b066df0870ee/não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Welcart e-Commerce
No mesmo produto, das mais perigosas para as menos.
CVE-2022-4140HIGHWelcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File AccessEPSS 3.2%CVE-2023-5952—Welcart e-Commerce < 2.9.5 - Unauthenticated PHP Object InjectionEPSS 1.3%CVE-2022-4237HIGHWelcart e-Commerce < 2.8.6 - Subscriber+ PHAR DeserialisationEPSS 1.1%CVE-2022-4236MEDIUMWelcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File AccessEPSS 0.9%CVE-2022-3935MEDIUMWelcart e-Commerce < 2.8.4 - Multiple Subscriber+ Stored Cross-Site ScriptingEPSS 0.5%CVE-2023-5953HIGHWelcart e-Commerce < 2.9.5 - Subscriber+ Arbitrary File UploadEPSS 0.5%