Improper privilege management in levelfourstorefront Shopping Cart & eCommerce Store
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.
Summary
The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly into update_option() without any allowlist, while gating the handler only on 'manage_options' OR the plugin's custom 'wpec_manager' capability. The plugin's built-in 'wpec_store_manager' role holds 'wpec_manager' but not 'manage_options', and the required nonce is emitted on frontend product/category templates that render for any user with 'wpec_manager'. This makes it possible for authenticated attackers, with Store Manager-level access and above, to elevate their privileges to administrator by updating arbitrary WordPress options such as default_role='administrator' and users_can_register='1', then self-registering a new account that is assigned the administrator role.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| levelfourstorefront | Shopping Cart & eCommerce Store | up to 5.9.3 | — | No fix listed | CNA |
- Shopping Cart & eCommerce Store Vendorlevelfourstorefront Affected up to 5.9.3 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wpeasycart:wp_easycart:*:*:*:*:*:*:*:* | — | — | levelfourstorefront |
- cpe:2.3:a:wpeasycart:wp_easycart:*:*:*:*:*:*:*:* Versions — — ·levelfourstorefront
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-17553
- 2026-10-03 Alias added: GHSA-p65j-77g8-24jh
- 2026-10-25 EPSS moved to the 50th–90th percentile
References
Other 7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/08e62276-f004-48ca-bb00-2f81e6ac4892?source=cve
- https://plugins.trac.wordpress.org/browser/wp-easycart/tags/5.9.1/wpeasycart.php#L7110
- https://plugins.trac.wordpress.org/browser/wp-easycart/tags/5.9.1/wpeasycart.php#L7107
- https://plugins.trac.wordpress.org/browser/wp-easycart/tags/5.9.1/wpeasycart.php#L7103
- https://plugins.trac.wordpress.org/browser/wp-easycart/tags/5.9.1/admin/inc/wp_easycart_admin.php#L209
- https://plugins.trac.wordpress.org/browser/wp-easycart/tags/5.9.1/design/layout/base-responsive-v3/ec_product_page.php#L415
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3681924%40wp-easycart&new=3681924%40wp-easycart
More levelfourstorefront vulnerabilities
- TI-2023-01063 Shopping Cart & eCommerce Store < 5.4.3 - Admin+ LFI CVSS 3.1HIGH 7.2
- TI-2014-07551 Unrestricted file upload vulnerability in… CVSS 2.0MEDIUM 6.5
- TI-2015-02358 The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in… CVSS 3.0HIGH 8.8
- TI-2024-07252 Shopping Cart & eCommerce Store <= 5.7.2 - Authenticated (Contributor+) SQL Injection via model_number Parameter CVSS 3.1HIGH 8.8
- TI-2024-03010 Shopping Cart & eCommerce Store <= 5.6.3 - Authenticated (Contributor+) SQL Injection CVSS 3.1HIGH 8.8
- TI-2021-13659 Shopping Cart & eCommerce Store <= 5.1.0 Cross-Site Request Forgery to Stored Cross-Site Scripting CVSS 3.1HIGH 8.8
Sources
- CVE-2026-17553 · CVE Program
- CVE-2026-17553 · NVD
- FIRST EPSS
- GHSA-p65j-77g8-24jh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences