The Welcart e-Commerce plugin for WordPress contains a generic SQL Injection flaw that is triggered through the 'wp_usces_order_old' cookie, specifically in the JSON fields 'searchSql' and 'searchSkuSql'. An attacker who is authenticated with an editor level (or higher) privilege can append malicious SQL statements to existing queries. This flaw permits the extraction of sensitive database content, potentially exposing customer data, orders, or payment information. The vulnerability is classified under CWE-89 and has a CVSS score of 4.9, indicating moderate severity with a focus on confidentiality and integrity risks rather than availability.

The affected product is the Welcart e-Commerce plugin developed by uscnanbu, bundled with WordPress sites. All released versions up to and including 2.12.4 are impacted. Users deploying any of these releases should verify their plugin version and consider an upgrade.

The CVSS score of 4.9 represents a moderate risk, and the EPSS score is not available, suggesting insufficient data on exploitation probability. The vulnerability is not listed in the CISA KEV catalog, further implying no confirmed widespread exploitation. Attackers must be able to authenticate with editor+ access to use the flaw, which limits the attack surface but still poses a significant risk if such accounts are compromised or privileged roles are over‑provisioned. Proper input sanitization is lacking, enabling attackers to inject arbitrary SQL into vulnerable queries.