---
id: CVE-2026-111032
title: >-
  Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and
  Disclosure via item_sku_ajax
summary: >-
  The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify
  authorization against the targeted product before processing SKU changes,
  because its capability check is not tied to the product being edited, allowing
  any a…
severity: low
cvss: 3.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-863
product: Welcart e-Commerce
affected:
  - welcart_e-commerce < 2.12.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-28T17:44:04.743495Z'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T17:58:06.341Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111032'
references:
  - url: 'https://wpscan.com/vulnerability/73a9a609-b647-4872-96d3-b066df0870ee/'
tags:
  - cve.org
epss: 0.00148
epssPercentile: 0.04015
ingestedAt: '2026-10-28T07:06:27.142Z'
---

## Overview

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with Author-level access or higher to read, modify, create, delete and re-order the SKU data (including prices, confidential cost prices and stock levels) of any product, including those belonging to other users.

## Affected

- `welcart_e-commerce < 2.12.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.