https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 09:20:03 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-17553 <p>The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly into update_option() without any allowlist, while gating the handler only on &#39;manage_options&#39; OR the plugin&#39;s custom &#39;wpec_manager&#39; capability. The plugin&#39;s built-in &#39;wpec_store_manager&#39; role holds &#39;wpec_manager&#39; but not &#39;manage_options&#39;, and the required nonce is emitted on frontend product/category templates that render for any user with &#39;wpec_manager&#39;. This makes it possible for authenticated attackers, with Store Manager-level access and above, to elevate their privileges to administrator by updating arbitrary WordPress options such as default_role=&#39;administrator&#39; and users_can_register=&#39;1&#39;, then self-registering a new account that is assigned the administrator role.</p> <p>The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly into update_option() without any allowlist, while gating the handler only on &#39;manage_options&#39; OR the plugin&#39;s custom &#39;wpec_manager&#39; capability. The plugin&#39;s built-in &#39;wpec_store_manager&#39; role holds &#39;wpec_manager&#39; but not &#39;manage_options&#39;, and the required nonce is emitted on frontend product/category templates that render for any user with &#39;wpec_manager&#39;. This makes it possible for authenticated attackers, with Store Manager-level access and above, to elevate their privileges to administrator by updating arbitrary WordPress options such as default_role=&#39;administrator&#39; and users_can_register=&#39;1&#39;, then self-registering a new account that is assigned the administrator role.</p> https://db.gcve.eu/vuln/fkie_cve-2026-17553 https://db.gcve.eu/vuln/ghsa-p65j-77g8-24jh <p>The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly into update_option() without any allowlist, while gating the handler only on &#39;manage_options&#39; OR the plugin&#39;s custom &#39;wpec_manager&#39; capability. The plugin&#39;s built-in &#39;wpec_store_manager&#39; role holds &#39;wpec_manager&#39; but not &#39;manage_options&#39;, and the required nonce is emitted on frontend product/category templates that render for any user with &#39;wpec_manager&#39;. This makes it possible for authenticated attackers, with Store Manager-level access and above, to elevate their privileges to administrator by updating arbitrary WordPress options such as default_role=&#39;administrator&#39; and users_can_register=&#39;1&#39;, then self-registering a new account that is assigned the administrator role.</p> <p>The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly into update_option() without any allowlist, while gating the handler only on &#39;manage_options&#39; OR the plugin&#39;s custom &#39;wpec_manager&#39; capability. The plugin&#39;s built-in &#39;wpec_store_manager&#39; role holds &#39;wpec_manager&#39; but not &#39;manage_options&#39;, and the required nonce is emitted on frontend product/category templates that render for any user with &#39;wpec_manager&#39;. This makes it possible for authenticated attackers, with Store Manager-level access and above, to elevate their privileges to administrator by updating arbitrary WordPress options such as default_role=&#39;administrator&#39; and users_can_register=&#39;1&#39;, then self-registering a new account that is assigned the administrator role.</p> https://db.gcve.eu/vuln/ghsa-p65j-77g8-24jh