CVE-2026-94124

The WP EasyCart plugin for WordPress up to version 5.9.3 is vulnerable to privilege escalation. The ec_ajax_save_page_default_options() AJAX handler iterates over every $_POST key and passes it directly to update_option() without an allowlist, while gating the handler only on 'manage_options' OR the plugin's custom 'wpec_manager' capability. The built-in 'wpec_store_manager' role holds 'wpec_manager' but not 'manage_options', and the required nonce is emitted on frontend product/category templates that render for any user with 'wpec_manager'. This allows authenticated attackers with Store Manager-level access and above to elevate their privileges to administrator by updating arbitrary WordPress options such as default_role='administrator' and users_can_register='1', then self-registering a new account that is assigned the administrator role.

The WP EasyCart plugin for WordPress versions 5.9.0 and earlier contains a SQL injection vulnerability via the 'contributor' attribute. This allows an attacker to manipulate database queries.

The WP EasyCart plugin from levelfourdevelopment is vulnerable to insertion of sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 5.8.11.