CVE-2026-107752

Executive Summary

CVE-2026-107752 is a SQL injection vulnerability (CWE-89) in the Welcart e-Commerce plugin for WordPress, affecting all versions up to and including 2.12.4. The flaw resides in handling of the wp_usces_order_old parameter — specifically the JSON fields searchSql and searchSkuSql — where user-supplied input is insufficiently escaped and the underlying SQL query is not adequately prepared, allowing an authenticated user with editor-level privileges or higher to append arbitrary SQL to existing queries. Successful exploitation permits extraction of sensitive information from the WordPress database, which for an e-commerce plugin commonly includes customer records, order history, and potentially stored credentials; the CVSS v3.1 base score is 4.9 (C:H/I:N/A:N), reflecting high confidentiality impact gated behind high privileges.

Technical Analysis

The vulnerability is a classic second-order-style SQL injection arising from string concatenation of user-controlled input into a database query without parameterization. According to the NVD description, the affected input path is the wp_usces_order_old parameter, and within it the JSON fields named searchSql and searchSkuSql. These field names strongly suggest the plugin accepts client-supplied query fragments (or fragments persisted and later re-consumed) that are assembled directly into an SQL statement rather than bound as parameters.

The root cause combines two deficiencies explicitly stated in the advisory: (1) insufficient escaping on the user-supplied parameter, and (2) lack of sufficient preparation on the existing SQL query. In WordPress plugin terms, this typically means the developer used direct interpolation (string building) into $wpdb queries instead of $wpdb->prepare() with placeholders. Because the injected content is appended to an already existing query, the attacker does not need to control the full statement — only a clause boundary, allowing techniques such as UNION SELECT, boolean/time-based blind inference, or stacked subqueries depending on the underlying DB driver.

The attack surface is the administrative order-management interface of the Welcart plugin (the wp_usces_order_old request parameter). Access control is the primary limiting factor: the CVSS vector specifies PR:H (high privileges required) and the description confirms editor-level access and above. AV:N/AC:L/UI:N indicate the flaw is remotely reachable over the network with low attack complexity and no user interaction once authenticated. S:U (unchanged scope) means the impact is confined to the vulnerable component's security authority — the WordPress database — while C:H confirms full read of data the query can reach. No write or availability impact is described (I:N/A:N), consistent with a read-oriented extraction primitive.

Because the vulnerable fields are named as search SQL/SKU SQL fields, the injection point is best characterized as a search feature whose query template is attacker-augmentable. Insufficient technical detail is available to name the specific PHP functions or file paths involved; the analysis above is derived strictly from the parameter names and deficiency description in the advisory.

Exploitation Scenarios

No public PoC or exploit code is available; the following chain is inferred from the vulnerability class and the parameters named in the NVD description.

1. Reconnaissance / target identification. An attacker enumerates WordPress sites running the Welcart e-Commerce plugin at a version ≤ 2.12.4 — for example by fingerprinting plugin assets or storefront behavior. Targets of interest are live shops where the attacker can obtain at least editor-level credentials (through phishing, credential stuffing, a compromised contractor account, or a separate WordPress privilege-escalation flaw).

2. Triggering the flaw class. Once authenticated at editor level or above, the attacker reaches the administrative order area where the wp_usces_order_old parameter is processed. They craft a request in which the JSON payload's searchSql and/or searchSkuSql fields contain SQL metacharacters/fragments. Because the value is concatenated into an existing query without escaping or prepared-statement binding (CWE-89), the injected fragment alters the executed SQL.

3. Payload / execution at the class level. The attacker appends query logic — e.g., UNION SELECT-style constructs to merge arbitrary result sets into the search output, or boolean/time-based predicates to infer data when output is not directly reflected. The attacker iterates requests to systematically read data from tables reachable by the query.

4. Post-exploitation impact. Extracted data can include customer and order records, and — because it is the WordPress database — often the wp_users table, from which password hashes may be cracked to escalate toward full administrative control. This pivots a mid-tier editor account into broad site and customer-data compromise.

Impact Assessment

Business impact centers on confidentiality of e-commerce data. With C:H the attacker can read the full breadth of data the SQL query can address, which for a WordPress installation routinely includes user accounts (and hashes), customer PII, and order history — triggering breach-notification and regulatory obligations (GDPR/CCPA) in many jurisdictions. Integrity and availability impacts are rated N, but practical follow-on effects are plausible: harvested hashes or admin credentials can enable further compromise beyond this CVE.

The blast radius is every WordPress site running Welcart e-Commerce ≤ 2.12.4 that exposes the administrative order interface to users at editor level or above. The PR:H requirement narrows the population of direct attackers, which is why the base score is moderate (4.9). However, editor accounts are frequently distributed to content staff and third parties, and are a favored target for initial access — lowering the practical barrier. The AV:N, AC:L, UI:N profile means exploitation, once credentials exist, is trivial and fully automatable. No CISA KEV listing and no EPSS score are currently available, indicating no confirmed mass exploitation as of this writing.

Detection Guidance

Sigma Rule

title: Welcart e-Commerce SQL Injection via wp_usces_order_old JSON Search Fields
id: 4b7c1e2a-9d63-4f0a-8c11-7e2f5a0b3d92
status: experimental
description: Detects HTTP requests targeting the Welcart wp_usces_order_old parameter with SQL keywords in the searchSql/searchSkuSql JSON fields.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107752
author: valtersit threat intelligence
logsource:
  category: webserver
detection:
  selection_param:
    cs-uri-query|contains: 'wp_usces_order_old'
  selection_sqli:
    cs-uri-query|contains:
      - 'searchSql'
      - 'searchSkuSql'
  selection_keywords:
    cs-uri-query|contains:
      - 'UNION'
      - 'union%20select'
      - 'SELECT%20'
      - 'information_schema'
      - 'SLEEP('
      - 'BENCHMARK('
      - '--%20'
      - "'%20OR%20"
  condition: selection_param and selection_sqli and selection_keywords
fields:
  - c-ip
  - cs-uri-query
  - cs-method
falsepositives:
  - Legitimate admin searches containing literal SQL-like strings
level: high

YARA Rule

rule CVE_2026_107752_Welcart_SQLi_Request
{
    meta:
        description = "Detects Welcart SQL injection attempts against wp_usces_order_old searchSql/searchSkuSql fields"
        cve = "CVE-2026-107752"
        author = "valtersit threat intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107752"
    strings:
        $p1 = "wp_usces_order_old" ascii wide nocase
        $s1 = "searchSql" ascii wide nocase
        $s2 = "searchSkuSql" ascii wide nocase
        $sql1 = "UNION SELECT" ascii wide nocase
        $sql2 = "information_schema" ascii wide nocase
        $sql3 = "SLEEP(" ascii wide nocase
        $sql4 = "BENCHMARK(" ascii wide nocase
    condition:
        $p1 and ($s1 or $s2) and any of ($sql*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107752 Welcart e-Commerce SQLi via wp_usces_order_old"; flow:established,to_server; http.method; content:"POST"; http.uri|url_decode; content:"wp_usces_order_old"; nocase; http.request_body; content:"searchSql"; nocase; pcre:"/(searchSql|searchSkuSql).{0,200}(union\s+select|information_schema|sleep\(|benchmark\()/is"; classtype:web-application-attack; sid:2026107752; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where network.protocol == "http" and http.request.method == "POST"
     and url.query : "wp_usces_order_old"]
  [network where network.protocol == "http" and http.request.method == "POST"
     and url.query : ("searchSql" or "searchSkuSql")
     and url.query : ("UNION" or "information_schema" or "SLEEP(" or "BENCHMARK(" or "-- ")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access
| eval uri_lower=lower(uri)
| where (like(uri_lower,"%wp_usces_order_old%") AND (like(uri_lower,"%searchsql%") OR like(uri_lower,"%searchskusql%")))
| where match(uri_lower,"union(\+|%20| )select|information_schema|sleep\(|benchmark\(|--(\+|%20)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as sample_uris by src_ip
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,appsec,sqli,">
  <rule id="2026107" level="12">
    <if_sid>31100,31101,31103,31104</if_sid>
    <url>wp_usces_order_old</url>
    <regex type="pcre2">(?i)(searchSql|searchSkuSql)</regex>
    <regex type="pcre2">(?i)(union\s+select|information_schema|sleep\(|benchmark\()</regex>
    <description>CVE-2026-107752: Welcart e-Commerce SQL injection attempt via wp_usces_order_old search fields</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,pci_dss_6.5.1,gdpr_IV_35.7.d,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1) Immediate mitigations. Restrict the WordPress editor role and above to the smallest possible set of trusted accounts, and remove editor-level access from contractors or integrations that do not strictly require it, since exploitation is gated behind PR:H. Enforce strong authentication (MFA) and unique credentials for all administrative users to counter the credential-theft prerequisite of the attack chain. If the plugin can be temporarily deactivated without breaking store operations (e.g., in staging or low-volume environments), do so until a verified fix is deployed. Deploy the detection rules above (WAF/Suricata/Sigma) in blocking or alert mode to catch injection attempts against wp_usces_order_old.

2) Patch/upgrade steps. The provided data indicates a patch is claimed by a single source (NVD) but does not specify a fixed version number or a vendor advisory URL, and confidence is 2/4. Do not assume 2.12.4 is the fixed release. Before upgrading: consult the upstream Welcart e-Commerce plugin release notes and the WordPress.org plugin changelog, confirm which version first remediates the wp_usces_order_old search handling, take a full database and file backup, test the upgrade in staging (order-history and search features specifically), then deploy. If no confirmed fixed version exists yet, treat mitigations in step 1 as the primary control and monitor the vendor channel for an authoritative release.

3) Long-term hardening. Enforce a least-privilege WordPress role model and periodic access reviews for editor/administrator accounts. Adopt a virtual patching/WAF layer that inspects POST bodies for SQL metacharacters on plugin endpoints. Maintain an inventory of installed plugins with automated CVE monitoring (this entry is a CWE-89 concatenation flaw in a widely deployed e-commerce plugin — versioning hygiene is the durable control). For plugin developers, migrate all $wpdb queries to $wpdb->prepare() with typed placeholders, and never accept client-supplied SQL fragments (searchSql/searchSkuSql) as query input. Enable database query logging/auditing and centralized web-access logging to support detection and forensics.

References

• NVD — CVE-2026-107752: https://nvd.nist.gov/vuln/detail/CVE-2026-107752
• WordPress.org plugin directory — Welcart e-Commerce (verify current release / changelog for the fixed version): https://wordpress.org/plugins/usc-e-shop/
• Welcart e-Commerce project documentation / release notes: https://www.welcart.com/
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CWE-89 — Improper Neutralization of Special Elements used in an SQL Command: https://cwe.mitre.org/data/definitions/89.html

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-107752 in the provided data; the CVE is not listed in CISA KEV, carries no EPSS score, and no public PoC or exploit code is currently available.