CVE-2025-10649: 
WordPress vulnerability analysis and mitigation

The Welcart e-Commerce plugin for WordPress contains a SQL Injection vulnerability (CVE-2025-10649) discovered and disclosed on October 8, 2025. The vulnerability affects all versions up to and including 2.11.21. This security issue stems from insufficient escaping of user-supplied values and inadequate SQL query preparation (NVD CVE).

The vulnerability is classified as SQL Injection (CWE-89) with a CVSS v3.1 base score of 6.5 (Medium), using the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The issue specifically involves insufficient escaping of cookie values that can be manipulated to inject additional SQL queries into existing database operations (Wordfence).

The vulnerability allows authenticated attackers with Author-level access or higher to append additional SQL queries to existing database operations. This can lead to unauthorized access to sensitive information stored in the database (NVD CVE).

The vulnerability requires authentication with at least Author-level privileges to exploit. The attack vector is network-accessible with low attack complexity, requiring no user interaction for successful exploitation (NVD CVE).

A patch has been released and is available through the WordPress plugin repository. Users are advised to update their Welcart e-Commerce plugin to the latest version (WordPress Plugin).