Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-17553— Shopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action

Quick assessment

Affected
levelfourstorefront Shopping Cart & eCommerce Store
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 WP EasyCart 插件在 5.9.3 及更早的版本中，存在权限提升漏洞。该漏洞源于 AJAX 处理函数：它会遍历 中的所有键，并直接将其传入 ，且未设置任何白名单限制；同时，该处理函数的执行条件仅为具备 权限或插件自定义的 权限。 插件内置的 角色拥有 权限，但不具备 权限。此外，所需的 nonce 会在前端的产品/分类模板中生成，这些模板会向任何拥有 权限的用户展示。 这使得具备“商店管理员”（Store Manager）或更高权限的已认证攻击者，能够更新任意 WordPress 选

CVSS 7.2 · High

Possible ATT&CK Techniques 1 AI

T1098 · Account Manipulation
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-17553

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Shopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action
Source: CVE Program / CVE List V5
Vulnerability Description
The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly into update_option() without any allowlist, while gating the handler only on 'manage_options' OR the plugin's custom 'wpec_manager' capability. The plugin's built-in 'wpec_store_manager' role holds 'wpec_manager' but not 'manage_options', and the required nonce is emitted on frontend product/category templates that render for any user with 'wpec_manager'. This makes it possible for authenticated attackers, with Store Manager-level access and above, to elevate their privileges to administrator by updating arbitrary WordPress options such as default_role='administrator' and users_can_register='1', then self-registering a new account that is assigned the administrator role.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
levelfourstorefront Shopping Cart & eCommerce Store 0 ~ 5.9.3 -

II. Public POCs for CVE-2026-17553

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-17553

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-17553 (1)

Other References for CVE-2026-17553 (4)

IV. Related Vulnerabilities

Same product: Shopping Cart & eCommerce Store
Same vendor: levelfourstorefront
Same weakness: CWE-269

V. Comments for CVE-2026-17553

No comments yet

Leave a comment