CVE-2026-94124

The WP EasyCart plugin for WordPress up to version 5.9.3 is vulnerable to privilege escalation. The ec_ajax_save_page_default_options() AJAX handler iterates over every $_POST key and passes it directly to update_option() without an allowlist, while gating the handler only on 'manage_options' OR the plugin's custom 'wpec_manager' capability. The built-in 'wpec_store_manager' role holds 'wpec_manager' but not 'manage_options', and the required nonce is emitted on frontend product/category templates that render for any user with 'wpec_manager'. This allows authenticated attackers with Store Manager-level access and above to elevate their privileges to administrator by updating arbitrary WordPress options such as default_role='administrator' and users_can_register='1', then self-registering a new account that is assigned the administrator role.

The WP EasyCart plugin for WordPress versions 5.9.0 and earlier contains a SQL injection vulnerability via the 'contributor' attribute. This allows an attacker to manipulate database queries.