WP EasyCart CVE-2026-17553

Exploitation requires an authenticated WordPress user account holding the plugin-assigned 'wpec_manager' capability, typically conferred by the built-in 'wpec_store_manager' role. The attacker must be able to load any frontend product or category page served by the WP EasyCart plugin in order to retrieve the AJAX nonce embedded in the page HTML - this page must be accessible to the Store Manager user, which is the default configuration. No non-default configuration setting is required; the vulnerability exists in the plugin's standard setup. Limiting factors: the attacker must have previously been granted Store Manager access by a site administrator (trust delegation is the prerequisite), the WP EasyCart plugin must be active, and a WordPress user registration endpoint must be reachable (users_can_register must be settable, which the exploit itself enables). Exploitation is not possible against WordPress installations where WP EasyCart is inactive or where no 'wpec_store_manager' role has been assigned to any user.

The CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects the requirement for a high-privilege credential (PR:H), which moderates the overall score. In practical terms, however, the 'wpec_store_manager' role is a routine operational assignment - site owners routinely grant it to employees or contractors for daily store management - broadening the realistic attacker pool beyond what a strict reading of PR:H implies. Attack complexity is genuinely low: no race condition, no memory corruption, and no guessing required; the nonce is simply read from any rendered product page. The C:H/I:H/A:H triad reflects the full administrator takeover that results. No EPSS data or KEV listing was provided, and no public exploit code has been identified at time of analysis, though the technique is well within the competence of any authenticated insider. Real-world priority is elevated for any WordPress site where the Store Manager role is delegated to personnel who are not fully trusted.

An employee granted the wpec_store_manager role on a WooCommerce competitor's WordPress store loads a product listing page, extracts the AJAX nonce embedded in the rendered HTML, and submits a crafted POST request to the ec_ajax_save_page_default_options handler setting default_role=administrator and users_can_register=1. The attacker then navigates to the site's standard user registration form, registers a new account under a separate email address, and is automatically assigned the WordPress administrator role - gaining full site control including access to the filesystem via plugin/theme editors.