CVE-2026-16080

CVE-2026-16080 is a SQL injection in a WordPress plugin's image upload handler, affecting versions up to and including 1.4.6. The vulnerability lives in the post_title parameter passed during media uploads — an author-level authenticated endpoint that fails to properly neutralize SQL metacharacters before interpolating them into a query. The CVSS 6.5 rating treats this as a medium-severity issue largely because it requires author authentication, but this framing obscures two critical factors that should drive your prioritization. First, author accounts in WordPress are far more prevalent and less monitored than administrator accounts. Every registered customer, contributor, or guest author on an e-commerce site has author-level access. On a WelCart deployment, a compromised author account can potentially access payment card data, customer PII, and order histories through crafted post_title payloads — not through slow boolean-based inference, but directly if the plugin's database user shares privileges with payment tables. WordPress e-commerce plugins routinely request broad database permissions during installation, and the default deployment pattern shares a single database user across the CMS and payment functionality. This means the exploit's blast radius isn't bounded by the wp_posts table where post_title lives. Second, the version boundary

Reviewed through automated stages and approved by a human before publication.