CVE-2026-75971 in ShopEngine Elementor WooCommerce Builder Addon Plugin
Summary
by MITRE • 08/25/2026
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the `rum_importer()` function being registered on the WordPress core `import_start` action hook with no plugin-owned capability check and no allowlist filtering, causing arbitrary `<wp_option>` name/value pairs parsed from an attacker-supplied WXR import file to be passed directly to `update_option()`. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to write arbitrary WordPress options — most critically setting `users_can_register` to `1` and `default_role` to `administrator` — enabling open self-registration of Administrator accounts and full site takeover. This is exploitable by Shop Manager-level users because WooCommerce grants that role the `import` capability, allowing it to reach the WordPress Importer flow that fires the `import_start` hook on which `rum_importer()` is registered, contrary to the assumption that the hook is restricted to Administrators.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to and including 4.9.4. This flaw stems from improper implementation of capability checks within the import functionality, specifically in the rum_importer function which is registered to fire during the import_start action hook. The core issue lies in the fact that this function accepts arbitrary data from a WordPress eXtended RSS (WXR) import file and passes it directly to the update_option function without validating whether the user has sufficient privileges or sanitizing the option names being modified. This lack of validation allows authenticated users with relatively low-level permissions to manipulate core WordPress configuration settings, leading to severe security consequences including full site takeover.
The technical mechanism of this vulnerability relies on a misunderstanding of capability distribution within the WooCommerce ecosystem. While many import-related hooks are restricted to administrators due to their high-privilege nature, WooCommerce grants the Shop Manager role the ability to perform imports as part of its standard operational workflow for managing products and orders. Consequently, when an attacker with Shop Manager-level access initiates an import process using a maliciously crafted WXR file, they can trigger the rum_importer function without encountering any authorization barriers. The function then processes key-value pairs from the imported data and writes them directly to the WordPress options table via update_option. Because there is no allowlist filtering for option names or capability verification before execution, attackers are free to overwrite critical system variables that control user registration policies and default role assignments.
The operational impact of this vulnerability is severe, as it enables an attacker with Shop Manager privileges to escalate their access level to Administrator. By manipulating the users_can_register option to a value of 1, the attacker opens up self-registration on the WordPress site. Simultaneously by setting the default_role option to administrator any new user account created through this open registration process will automatically be assigned administrative rights. This combination allows an attacker to create unlimited administrator accounts without needing further authentication or approval from existing administrators effectively granting them complete control over the website including access to plugins themes database and server-level configurations if exposed.
This vulnerability aligns with CWE-269 Improper Privilege Management as it involves a failure to enforce proper authorization checks before allowing actions that modify sensitive system state. It also relates to CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component because the plugin fails to sanitize or validate input data from external sources before processing it through core WordPress functions. In terms of MITRE ATT&CK framework this behavior corresponds to T1098 Account Manipulation specifically the aspect of additional cloud accounts creation and potentially T1546 Event Triggered Execution if viewed as leveraging hooks for unauthorized execution though primarily it is a privilege escalation via configuration manipulation rather than direct code execution.
Mitigation strategies should focus on immediate patching and access control hardening. Site administrators must update the ShopEngine Elementor WooCommerce Builder Addon plugin to version 4.9.5 or later where these capability checks have been properly implemented. Until patches are applied it is advisable to restrict import capabilities exclusively to users with Administrator-level privileges by modifying role definitions in WordPress code if possible and monitoring for unusual user registration activity particularly those resulting from self-registration flows that were previously disabled. Additionally implementing strict input validation on all custom importer functions within plugins can prevent similar vulnerabilities where external data influences core system configuration without adequate verification of source integrity or user authority ensuring that only authorized modifications to critical options are permitted by the application logic.