CVE-2026-17553

WP EasyCart versions up to and including 5.9.3 for WordPress contain an authenticated privilege-escalation flaw (CWE-269) in the ec_ajax_save_page_default_options() AJAX handler, which passes every submitted POST key directly into update_option() without any allowlist. The handler is gated only on 'manage_options' OR the plugin's custom 'wpec_manager' capability, and the required nonce is emitted on frontend product/category templates, so any user with Store Manager-level access can submit arbitrary option updates such as default_role='administrator' and users_can_register='1'. The attacker can then self-register a new account that WordPress assigns the administrator role, achieving full administrative control of the site; the flaw is rated 7.2 (High) in CVSS 3.1. Any WordPress site running WP EasyCart 5.9.3 or earlier where non-administrator users hold the Store Manager role is affected. There is currently no public proof of concept, the issue is not listed in CISA's KEV, and no exploitation has been reported.

What to do: Update WP EasyCart to the latest patched release beyond 5.9.3 as soon as it is available; until then, restrict the Store Manager role (wpec_manager) to trusted staff or consider temporarily deactivating the plugin. Administrators should also audit the options table for tampering with default_role and users_can_register, and review recently created administrator accounts for signs of attacker self-registration.