CVE-2025-10649

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10649", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-17T18:15:39.316Z", "datePublished": "2025-10-08T11:16:54.824Z", "dateUpdated": "2026-04-08T16:51:26.852Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:26.852Z"}, "affected": [{"vendor": "uscnanbu", "product": "Welcart e-Commerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.11.21", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Welcart e-Commerce plugin for WordPress is vulnerable to SQL Injection via the cookie in all versions up to, and including, 2.11.21 due to insufficient escaping on the user supplied value and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "Welcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4d59eedb-550f-44c1-a0cd-609c5661134d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3374119/usc-e-shop"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "timeline": [{"time": "2025-09-17T18:31:20.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-07T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-08T13:26:53.546528Z", "id": "CVE-2025-10649", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-08T13:27:52.426Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10649", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-08T13:26:53.546528Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-08T13:27:43.059Z"}}], "cna": {"title": "Welcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie", "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "uscnanbu", "product": "Welcart e-Commerce", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.11.21"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-17T18:31:20.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-07T00:00:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4d59eedb-550f-44c1-a0cd-609c5661134d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3374119/usc-e-shop"}], "descriptions": [{"lang": "en", "value": "The Welcart e-Commerce plugin for WordPress is vulnerable to SQL Injection via the cookie in all versions up to, and including, 2.11.21 due to insufficient escaping on the user supplied value and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-08T11:16:54.824Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10649", "state": "PUBLISHED", "dateUpdated": "2025-10-08T13:27:52.426Z", "dateReserved": "2025-09-17T18:15:39.316Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-08T11:16:54.824Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Welcart e-Commerce", "vendor": "uscnanbu", "versions": [{"lessThanOrEqual": "2.11.21", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Welcart e-Commerce plugin for WordPress is vulnerable to SQL Injection via the cookie in all versions up to, and including, 2.11.21 due to insufficient escaping on the user supplied value and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin Welcart e-Commerce para WordPress es vulnerable a inyecci\u00f3n SQL a trav\u00e9s de la cookie en todas las versiones hasta la 2.11.21, inclusive, debido a un escape insuficiente en el valor proporcionado por el usuario y a la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes autenticados, con acceso de nivel de Autor y superior, a\u00f1adan consultas SQL adicionales a consultas ya existentes que pueden ser utilizadas para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2025-10649", "lastModified": "2026-10-08T13:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10649", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-08T13:26:53.546528Z", "version": "2.0.3"}}]}, "published": "2025-10-08T12:15:36.047", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3374119/usc-e-shop"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4d59eedb-550f-44c1-a0cd-609c5661134d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:12:04.294172+00:00", "value": {"mitigation_remediation": ["Upgrade the Welcart e-Commerce plugin to the latest version released after 2.11.21", "Disable the plugin if it cannot be upgraded until a patch is applied", "Ensure that all WordPress installations are running the latest core and plugin versions and enforce least privilege for author role accounts"], "summary": {"action": "Patch Now", "impact": "Data Exfiltration via SQL Injection"}, "threat_synthesis": {"affected_systems": "All installations of Welcart e-Commerce version 2.11.21 or earlier on WordPress sites. The plugin is distributed by the vendor uscnanbu. Users running these versions are susceptible; newer releases beyond 2.11.21 are not affected.", "description_and_impact": "The Welcart e-Commerce plugin for WordPress contains a SQL Injection flaw that an attacker can exploit by manipulating a cookie. The insufficient escaping of user supplied values in the query construction allows the execution of arbitrary SQL statements. The associated weakness is CWE-89. An attacker with Author or higher privileges can craft a cookie to append malicious SQL that may read or modify sensitive database contents, leading to data theft or corruption. The attack vector is inferred from the description: the vulnerability is triggered by sending a crafted cookie in an authenticated web request, though the CVE entry does not explicitly state the transport mechanism.", "risk_and_exploitability": "The CVSS score of 6.5 indicates a medium severity. The EPSS score of less than 1% shows a very low probability of exploitation at this time, and it is not listed in the CISA KEV catalog. However, the vulnerability requires authenticated access with Author-level privileges, which many site administrators or content authors possess. Attackers can trigger the flaw by sending an HTTP request containing a crafted cookie; this inference is based on the description that manipulation occurs via a cookie. Thus the likely attack vector is an authenticated web request with a modified cookie. Given the limited scope of required privileges, the risk is moderate but could be severe if the attacker gains access to privileged accounts."}}}}, "created": "2025-10-09T12:51:46.723799+00:00", "updated": "2026-04-22T14:15:20.421249+00:00", "vendors": ["welcart", "welcart$PRODUCT$e-commerce", "welcart$PRODUCT$welcart", "welcart$PRODUCT$welcart_e-commerce", "wordpress", "wordpress$PRODUCT$wordpress"]}