CVE-2026-16080 is a SQL Injection vulnerability (CWE-89) in the Image Uploader for Welcart WordPress plugin. The issue occurs due to improper neutralization of special elements in the 'post_title' parameter, allowing authenticated attackers with author-level privileges or above to inject arbitrary SQL commands. This is caused by insufficient escaping of user input and lack of prepared statements in the affected SQL queries. The vulnerability affects all versions up to and including 1.4.6. No known exploits are reported in the wild, and no official fix or patch has been documented as of the publication date.

An attacker with author-level access or higher can exploit this vulnerability to execute additional SQL queries on the database. This can lead to unauthorized disclosure of sensitive information stored in the database. The vulnerability does not impact integrity or availability directly but poses a confidentiality risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict author-level access to trusted users only and monitor for suspicious activity related to the plugin. Avoid using the vulnerable versions if possible.