Shopping Cart Ecommerce Store
Monthly
WP EasyCart (Shopping Cart & eCommerce Store) versions up to and including 5.9.3 exposes a privilege escalation path allowing authenticated Store Manager-level users to promote themselves to WordPress administrator. The `ec_ajax_save_page_default_options()` AJAX handler accepts arbitrary POST parameters and writes them directly to the WordPress options table via `update_option()` without any allowlist, while its nonce is embedded in frontend product and category templates accessible to any user holding the plugin's custom 'wpec_manager' capability. No public exploit code has been identified at time of analysis, but the attack technique is mechanically straightforward and requires only a Store Manager credential to execute.
Second-order SQL injection in the WP EasyCart (Shopping Cart & eCommerce Store) WordPress plugin through version 5.9.2 allows authenticated administrators to extract arbitrary data from the WordPress database. The attack is a two-stage operation: a malicious payload is first written to the ec_pageoption table via the ec_ajax_save_page_options handler without any sanitization, then on subsequent store page renders the value is retrieved and processed through stripslashes() - which strips WordPress's magic-quote escaping - before being concatenated directly into a live SQL query in ec_filter.php. No public exploit has been identified at time of analysis, and the PR:H requirement substantially constrains the realistic attacker population.
The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_currency_settings function found in the ~/admin/inc/wp_easycart_admin_initial_setup.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
WP EasyCart (Shopping Cart & eCommerce Store) versions up to and including 5.9.3 exposes a privilege escalation path allowing authenticated Store Manager-level users to promote themselves to WordPress administrator. The `ec_ajax_save_page_default_options()` AJAX handler accepts arbitrary POST parameters and writes them directly to the WordPress options table via `update_option()` without any allowlist, while its nonce is embedded in frontend product and category templates accessible to any user holding the plugin's custom 'wpec_manager' capability. No public exploit code has been identified at time of analysis, but the attack technique is mechanically straightforward and requires only a Store Manager credential to execute.
Second-order SQL injection in the WP EasyCart (Shopping Cart & eCommerce Store) WordPress plugin through version 5.9.2 allows authenticated administrators to extract arbitrary data from the WordPress database. The attack is a two-stage operation: a malicious payload is first written to the ec_pageoption table via the ec_ajax_save_page_options handler without any sanitization, then on subsequent store page renders the value is retrieved and processed through stripslashes() - which strips WordPress's magic-quote escaping - before being concatenated directly into a live SQL query in ec_filter.php. No public exploit has been identified at time of analysis, and the PR:H requirement substantially constrains the realistic attacker population.
The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_currency_settings function found in the ~/admin/inc/wp_easycart_admin_initial_setup.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.