Description

The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'post_title' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-15T03:16:48.207Z",
  "pubdate": "2026-08-15T03:16:48.207Z",
  "executiveSummary": "The Image Uploader for Welcart plugin for WordPress is affected by a generic SQL Injection vulnerability impacting all versions up to, and including, 1.4.6.\nThe vulnerability exists due to insufficient escaping of user-supplied input provided via the 'post_title' parameter and a lack of proper query preparation by the application.\nThis security flaw allows authenticated attackers possessing author-level access or higher to manipulate database queries by appending arbitrary SQL commands.\nSuccessful exploitation of this vulnerability enables malicious actors to extract sensitive information stored within the underlying database, leading to potential confidentiality breaches and unauthorized data exposure.\nThe risk implication is significant as it compromises database integrity and data privacy through authenticated privilege abuse.\nMitigation requires updating the plugin to a secure version if available, or implementing strict input sanitization and parameterized queries for the vulnerable 'post_title' parameter.",
  "technicalDetails": "The vulnerability is classified as a generic SQL Injection flaw residing within the Image Uploader for Welcart plugin for WordPress across all versions up to, and including, 1.4.6.\nThe root cause of the vulnerability stems from inadequate sanitization and escaping mechanisms applied to user-supplied input passed through the 'post_title' parameter, combined with the absence of prepared statements or query parameterization in the existing SQL query construction.\nAttackers must possess authenticated access with a minimum privilege level of an author to interact with the vulnerable component and supply malicious input.\nThe attack flow proceeds as follows: First, the authenticated attacker crafts a malicious payload incorporating SQL syntax targeting the 'post_title' parameter during an image upload or related plugin operation. Second, the plugin accepts the unsanitized input and directly concatenates it into the dynamic SQL query string executed against the database backend. Third, the database parser evaluates the concatenated input as executable SQL commands, allowing the attacker to break out of the intended query context. Finally, the attacker can append UNION-based or error-based SQL injection payloads to extract sensitive information from database tables.\nThe vulnerable component is responsible for handling database interactions associated with the 'post_title' parameter within the Image Uploader for Welcart plugin.\nPost-exploitation impact includes the unauthorized extraction of sensitive database contents, such as user credentials, configuration data, and other restricted records accessible to the database user context."
}