CVE-2026-75971

Summary

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the rum_importer() function being registered on the WordPress core import_start action hook with no plugin-owned capability check and no allowlist filtering, causing arbitrary <wp_option> name/value pairs parsed from an attacker-supplied WXR import file to be passed directly to update_option(). This makes it possible for authenticated attackers, with Shop Manager-level access and above, to write arbitrary WordPress options — most critically setting users_can_register to 1 and default_role to administrator — enabling open self-registration of Administrator accounts and full site takeover. This is exploitable by Shop Manager-level users because WooCommerce grants that role the import capability, allowing it to reach the WordPress Importer flow that fires the import_start hook on which rum_importer() is registered, contrary to the assumption that the hook is restricted to Administrators.

Affected Software

VendorProductVersion RangeStatus
roxnorShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets0 <= 4.9.4affected

Weaknesses

  • CWE-269: CWE-269 Improper Privilege Management

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References