WP EasyCart EUVD-2026-68970

Requires an authenticated WordPress session with administrator-level role or higher - confirmed by CVSS PR:H. The vulnerable code path is triggered specifically by the ec_ajax_save_page_options AJAX handler, which processes the 'product_order' POST parameter. The second stage requires that a store page exist and be rendered (either by the attacker or any site visitor) after the payload is written, making this a stored/deferred injection rather than an immediate one. Exploitation is constrained to WordPress installations running WP EasyCart 5.9.2 or earlier. There is no indication of exploitability against default WordPress configurations without the plugin installed. The use of stripslashes() as a data-retrieval step is the specific mechanism that defeats WordPress's legacy magic-quotes defense; this behavior is present in the 5.9.1 source confirmed in the plugin SVN repository.

The CVSS 3.1 score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) accurately reflects the dual nature of this finding: the network attack vector and low complexity inflate the theoretical risk, while the PR:H requirement for WordPress administrator credentials substantially narrows the realistic attacker population to insiders, credential-compromise scenarios, or privilege-escalation chains. The confidentiality impact is genuine - C:H represents the ability to exfiltrate customer PII, order history, hashed credentials, and any other data in the WordPress database. However, integrity and availability are unaffected (I:N/A:N), limiting blast radius to data theft. No KEV listing and no POC availability are reported, and the second-order nature of the attack (requiring two separate HTTP interactions and knowledge of the internal data flow) adds practical friction against automated exploitation. EPSS data is not provided in the input. Real-world priority is moderate for stores with externally accessible admin panels or shared-hosting environments where admin credentials may be weaker.

An attacker who has obtained WordPress administrator credentials - via phishing, credential stuffing, or privilege escalation - submits a crafted SQL fragment through the product_order POST parameter to the ec_ajax_save_page_options handler. The payload is stored verbatim in the ec_pageoption table. When any store page is subsequently rendered, the payload is retrieved, stripslashes() removes protective escaping, and the fragment is appended to an ORDER BY SQL clause, causing the database to return attacker-specified data such as user password hashes or customer records in the HTTP response or error output. No public exploit code has been identified at time of analysis.