CVE-2026-17553
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The WP EasyCart plugin for WordPress up to version 5.9.3 is vulnerable to privilege escalation. The ec_ajax_save_page_default_options() AJAX handler iterates over every $_POST key and passes it directly to update_option() without an allowlist, while gating the handler only on 'manage_options' OR the plugin's custom 'wpec_manager' capability. The built-in 'wpec_store_manager' role holds 'wpec_manager' but not 'manage_options', and the required nonce is emitted on frontend product/category templates that render for any user with 'wpec_manager'. This allows authenticated attackers with Store Manager-level access and above to elevate their privileges to administrator by updating arbitrary WordPress options such as default_role='administrator' and users_can_register='1', then self-registering a new account that is assigned the administrator role.
Risk Assessment
An attacker with limited privileges could gain full control over the WordPress installation, potentially leading to site takeover, data theft, or further attacks.
Recommendation
Update the plugin to a version newer than 5.9.3 if available, or restrict access to roles with 'wpec_manager' capability and monitor for unusual option changes.
Other vulnerabilities in WP EasyCart
See allOriginal NVD description (English source)
The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly into update_option() without any allowlist, while gating the handler only on 'manage_options' OR the plugin's custom 'wpec_manager' capability. The plugin's built-in 'wpec_store_manager' role holds 'wpec_manager' but not 'manage_options', and the required nonce is emitted on frontend product/category templates that render for any user with 'wpec_manager'. This makes it possible for authenticated attackers, with Store Manager-level access and above, to elevate their privileges to administrator by updating arbitrary WordPress options such as default_role='administrator' and users_can_register='1', then self-registering a new account that is assigned the administrator role.