Privilege Escalation in WP EasyCart Plugin

WP EasyCart plugin versions up to and including 5.9.3 contain a critical privilege escalation vulnerability rooted in the ec_ajax_save_page_default_options() AJAX handler. The vulnerability stems from improper input validation where the handler iterates over all provided POST parameters and passes them directly to the update_option() function without an allowlist.

Although the handler requires either the 'manage_options' capability or the plugin-specific 'wpec_manager' capability, the nonce required to invoke this function is exposed to users holding the 'wpec_store_manager' role. By exploiting this, an authenticated attacker with Store Manager access can modify arbitrary WordPress database options. Attackers can specifically target 'default_role' and 'users_can_register' to force self-registered accounts into the administrator role, resulting in full site compromise.

Attack Chain

1. Attacker authenticates to the target WordPress site with the 'wpec_store_manager' role.
2. Attacker navigates to a frontend product or category template to obtain the required nonce.
3. Attacker crafts an HTTP POST request targeting the ec_ajax_save_page_default_options() handler.
4. Attacker includes 'default_role' set to 'administrator' in the POST data.
5. Attacker includes 'users_can_register' set to '1' in the POST data.
6. The plugin handler updates the WordPress options table with the malicious values.
7. Attacker triggers the registration process to create a new user account.
8. The new account is automatically assigned the administrator role upon registration.

Impact

Successful exploitation allows an attacker with limited store-management access to escalate privileges to full administrative control over the WordPress instance. This leads to complete site compromise, including the ability to execute arbitrary code, modify content, extract sensitive data, and install backdoors.

Recommendation

Update the WP EasyCart plugin to the latest version (v5.9.4 or higher) immediately to patch the vulnerable AJAX handler. If patching is not immediately feasible, restrict access to the dashboard for 'wpec_store_manager' roles or monitor for unusual administrative user registration events.