ShopEngine CVE-2026-75971

Exploitation requires an authenticated session with Shop Manager-level access (or higher) within a WordPress installation running WooCommerce and ShopEngine 4.9.4 or earlier. WooCommerce must be active because it is the source of the import capability grant to the Shop Manager role; without WooCommerce, Shop Managers do not ordinarily possess that capability. The WordPress Importer (core feature or plugin) must be accessible to the Shop Manager account. The critical limiting factor is possession of a valid Shop Manager (or Administrator) account - unauthenticated attackers cannot reach the import_start hook. There is no requirement for any non-standard plugin configuration beyond the default ShopEngine installation on a WooCommerce site. Exploitation is not limited by network position (AV:N, AC:L) once credentials are available: the import endpoint is accessible over the standard web interface. Post-exploitation open registration persists until the users_can_register option is reverted, meaning the window of exposure for secondary attacker account creation extends beyond the initial attack session.

The NVD-assigned CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects network accessibility and high CIA impact but applies PR:H because exploitation requires Shop Manager-level credentials. This PR:H rating may cause teams to deprioritize the finding, but real-world risk is materially higher than the score implies: Shop Manager is a routinely delegated role in WooCommerce stores (store staff, contractors, fulfillment partners), and compromise of any such account directly translates to full WordPress Administrator takeover within a single, low-complexity attack step. The S:U (Unchanged scope) designation in the vendor vector is debatable - the vulnerability in ShopEngine's import handler ultimately writes to WordPress core option tables and creates administrator accounts, which crosses the plugin's own security boundary into the WordPress installation as a whole; this analysis independently assesses S:C. No EPSS score, no CISA KEV entry, and no confirmed public exploit code were present in the provided data, so exploitation probability cannot be quantified, but the attack primitive is trivial: craft a WXR XML file with two option entries and run a standard WordPress import. The Wordfence advisory documents the exact mechanism, reducing any meaningful barrier to exploitation. The primary limiting factor is possessing an authenticated Shop Manager account, making this a significant risk for any multi-user WooCommerce deployment.

An attacker with a Shop Manager account - obtained through credential theft, phishing of a store employee, or abuse of a shared fulfillment account - crafts a WXR XML file containing two <wp:option> entries: one setting users_can_register to 1 and one setting default_role to administrator. The attacker uploads this file through the standard WordPress import interface, which fires the import_start hook and invokes ShopEngine's unguarded rum_importer(), writing both options to the database. The attacker (or a collaborator) then registers a new user account at the site's registration URL, receives Administrator privileges automatically, and has unrestricted control over the WordPress installation. No public exploit code is confirmed in the provided data, but the attack requires only standard WordPress tooling and a valid WXR file.