Webkul QloApps: Three High-Severity Flaws Including RCE Disclosed Together
Three high-severity vulnerabilities, including SQL injection and remote code execution, were disclosed in Webkul QloApps on August 25, 2026.
Key findings
- Three high-severity vulnerabilities (CVSSv3 7.2) disclosed in Webkul QloApps on August 25, 2026.
- Two SQL injection vulnerabilities (CVE-2026-75498, CVE-2026-75497) allow authenticated admins to manipulate database queries.
- One remote code execution vulnerability (CVE-2026-75496) allows authenticated admins to upload and execute arbitrary files.
- All vulnerabilities fixed in a single coordinated patch by Webkul.
On August 25, 2026, three high-severity vulnerabilities were disclosed in Webkul's QloApps, a popular e-commerce platform. The vulnerabilities, all rated with a CVSSv3 score of 7.2, were published together, indicating a coordinated disclosure event. These flaws could allow authenticated attackers with administrative privileges to execute arbitrary SQL queries or even achieve remote code execution.
Two of the vulnerabilities, CVE-2026-75498 and CVE-2026-75497, stem from improper validation of request parameters before database queries. In both cases, a remote, authenticated attacker with administrative privileges can send a crafted SQL query to the 'bo_query' parameter. CVE-2026-75498 affects the 'Address.php' file, while CVE-2026-75497 impacts the 'CustomerMessage.php' file. These SQL injection flaws could lead to unauthorized data access or manipulation within the QloApps database.
The third vulnerability, CVE-2026-75496, presents a more severe risk, allowing for remote code execution. This flaw arises from QloApps' failure to properly validate uploaded file extensions or MIME types before moving them to a publicly accessible directory. An authenticated attacker with administrative privileges could exploit this by uploading executable files, thereby gaining control over the server.
All three vulnerabilities were addressed by Webkul in a single commit, identified as '123c97c' for the SQL injection flaws and '153ec1c' for the file upload vulnerability. Users of Webkul QloApps are strongly advised to update their installations to the patched versions to mitigate these security risks. The coordinated disclosure of these high-severity issues underscores the importance of timely patching for e-commerce platforms to protect sensitive customer and business data.