CVE-2026-16065 is a SQL injection vulnerability (CWE-89) in the Welcart e-Commerce WordPress plugin versions prior to 2.11.32. The vulnerability occurs due to improper sanitization of values imported from CSV files before being used in SQL queries. Users with Editor or higher privileges, including custom roles for shop management, can exploit this to execute arbitrary SQL commands. The CVSS v3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity but no impact on availability.

Successful exploitation allows privileged users (Editor role or above) to perform SQL injection attacks, potentially leading to unauthorized data access or modification within the database. This compromises the confidentiality and integrity of the affected system's data. There is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 2.11.32, upgrading to version 2.11.32 or later is recommended once the vendor confirms the fix. Until then, restrict Editor and higher roles from importing CSV files or performing actions that involve this functionality if possible.