Shopping Cart & eCommerce Store <= 5.9.3 — Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under WP EasyCart: Shopping Cart and eCommerce Store.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 5.9.4, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch WP EasyCart: Shopping Cart and eCommerce Store to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Wordfence PRISM.

The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly into update_option() without any allowlist, while gating the handler only on 'manage_options' OR the plugin's custom 'wpec_manager' capability. The plugin's built-in 'wpec_store_manager' role holds 'wpec_manager' but not 'manage_options', and the required nonce is emitted on frontend product/category templates that render for any user with 'wpec_manager'. This makes it possible for authenticated attackers, with Store Manager-level access and above, to elevate their privileges to administrator by updating arbitrary WordPress options such as default_role='administrator' and users_can_register='1', then self-registering a new account that is assigned the administrator role.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Sep 8, 2026

   CVE published

   Severity high, CVSS 7.2

2. Nov 13, 2026

   Record last updated