CVE-2026-16080 describes a SQL Injection vulnerability (CWE-89) in the Image Uploader for Welcart plugin for WordPress. The flaw exists in the handling of the 'post_title' parameter, which is not properly escaped or prepared before being used in SQL queries. This allows authenticated attackers with author-level privileges or above to inject additional SQL commands into existing queries, enabling unauthorized data extraction from the database. The vulnerability affects all plugin versions up to and including 1.4.6. There is no vendor advisory or patch currently available to address this issue.

An attacker with author-level access or higher can exploit this vulnerability to extract sensitive information from the database by injecting additional SQL queries. The confidentiality of the database is at risk, but integrity and availability impacts are not indicated. The vulnerability requires authenticated access with a relatively low privilege level (author), increasing the risk within compromised or insider threat scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict author-level access to trusted users only and monitor for suspicious activity related to the 'post_title' parameter. Avoid using the affected plugin versions if possible.