Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-75971— ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes

Quick assessment

Affected
roxnor ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress ShopEngine Elementor WooCommerce Builder Addon是WordPress基金会的一款电商网站构建器插件组件，实现页面可视化编辑与商城功能整合。 WordPress ShopEngine Elementor WooCommerce Builder Addon 4.9.4及之前版本存在权限许可和访问控制问题漏洞，该漏洞源于rum_importer()函数注册在WordPress核心import_start动作钩子上，未进行插件自身能力检查和白名单过滤

CVSS 7.2 · High EPSS 0.58% · P46
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75971

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes
Source: CVE Program / CVE List V5
Vulnerability Description
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the `rum_importer()` function being registered on the WordPress core `import_start` action hook with no plugin-owned capability check and no allowlist filtering, causing arbitrary `<wp_option>` name/value pairs parsed from an attacker-supplied WXR import file to be passed directly to `update_option()`. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to write arbitrary WordPress options — most critically setting `users_can_register` to `1` and `default_role` to `administrator` — enabling open self-registration of Administrator accounts and full site takeover. This is exploitable by Shop Manager-level users because WooCommerce grants that role the `import` capability, allowing it to reach the WordPress Importer flow that fires the `import_start` hook on which `rum_importer()` is registered, contrary to the assumption that the hook is restricted to Administrators.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress ShopEngine Elementor WooCommerce Builder Addon 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress ShopEngine Elementor WooCommerce Builder Addon是WordPress基金会的一款电商网站构建器插件组件，实现页面可视化编辑与商城功能整合。 WordPress ShopEngine Elementor WooCommerce Builder Addon 4.9.4及之前版本存在权限许可和访问控制问题漏洞，该漏洞源于rum_importer()函数注册在WordPress核心import_start动作钩子上，未进行插件自身能力检查和白名单过滤
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
roxnor ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets 0 ~ 4.9.4 -

II. Public POCs for CVE-2026-75971

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-75971

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-75971 (1)

Vendor Advisories for CVE-2026-75971 (1)

Same Patch Batch · roxnor · 2026-08-25 · 4 CVEs total

CVE-2026-76063 6.4 MEDIUM FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_fea
CVE-2026-18100 6.4 MEDIUM MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_i
CVE-2026-75930 4.3 MEDIUM FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post

IV. Related Vulnerabilities

Same product: ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets
Same vendor: roxnor
Same weakness: CWE-269

V. Comments for CVE-2026-75971

No comments yet

Leave a comment