Level Four Storefront WP EasyCart Plugin up to 5.9.3 on WordPress AJAX ec_ajax_save_page_default_options privileges management

Summaryinfo

A vulnerability, which was classified as critical, has been found in Level Four Storefront WP EasyCart Plugin up to 5.9.3. Affected by this vulnerability is the function ec_ajax_save_page_default_options of the component AJAX Handler. The manipulation leads to privileges management. This vulnerability is listed as CVE-2026-17553. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Level Four Storefront WP EasyCart Plugin up to 5.9.3 and classified as critical. This issue affects the function ec_ajax_save_page_default_options of the component AJAX Handler. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly into update_option() without any allowlist, while gating the handler only on 'manage_options' OR the plugin's custom 'wpec_manager' capability. The plugin's built-in 'wpec_store_manager' role holds 'wpec_manager' but not 'manage_options', and the required nonce is emitted on frontend product/category templates that render for any user with 'wpec_manager'. This makes it possible for authenticated attackers, with Store Manager-level access and above, to elevate their privileges to administrator by updating arbitrary WordPress options such as default_role='administrator' and users_can_register='1', then self-registering a new account that is assigned the administrator role.

It is possible to read the advisory at wordfence.com. The identification of this vulnerability is CVE-2026-17553 since 07/27/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/09/2026). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• Level Four Storefront

Name

• WP EasyCart Plugin

Version

• 5.9.0
• 5.9.1
• 5.9.2
• 5.9.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion