Security Alert Summary
Authenticated users with Shop Manager-level access can exploit the WordPress import flow in the ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin to write arbitrary WordPress options via a crafted WXR import file. This can allow an attacker to enable open user registration and set the default role to administrator, potentially resulting in administrator account creation and site takeover. Affected versions include all releases up to and including 4.9.4.
CVE Details
- CVE ID: CVE-2026-75971
- Affected component: ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress
- Affected versions: All versions up to and including 4.9.4
- Published: August 25, 2026 at 12:16:25 PM UTC
- Last modified: August 25, 2026 at 1:19:29 PM UTC
- CVSS v3.1: 7.2 (HIGH) –
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Authentication / privileges / user interaction: Privileges Required: High; User Interaction: None. The advisory notes exploitation by users with Shop Manager-level access via the importer flow.
- Impact (CIA): Confidentiality: High; Integrity: High; Availability: High
- CWE: CWE-269
Technical Details
The vulnerability exists because the rum_importer() function is registered on the WordPress core import_start action hook without a plugin-owned capability check and without allowlist filtering. Arbitrary <wp_option> name/value pairs parsed from an attacker-supplied WXR import file are passed directly to update_option(), allowing the plugin to write arbitrary options. The advisory specifically identifies the ability to set users_can_register to 1 and default_role to administrator, which enables open self-registration of Administrator accounts. The report notes this is exploitable by Shop Manager-level users because WooCommerce grants that role the import capability, allowing that role to reach the WordPress Importer flow that fires the import_start hook.
How This Could Impact Your Website
Consider a small eCommerce site where the site owner delegates catalog and order management to internal staff and an external contractor. A staff member or contractor who has Shop Manager-level access could import a malicious WXR file that modifies WordPress options, enabling open registration and assigning new accounts the administrator role. The practical consequences include exposure of internal user email addresses, an increased risk of targeted phishing or social engineering against staff and contractors, and the potential for elevated privileges that allow an attacker to perform administrative actions. professional review may be worth considering if you are unsure whether your site is affected or how to assess your current user roles and plugins.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and Shop Manager-equivalent roles.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and import actions for unusual behavior.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/shopengine/tags/4.9.4/core/builders/base.php#L57
- https://plugins.trac.wordpress.org/browser/shopengine/tags/4.9.4/core/export-import/import.php#L19
- https://plugins.trac.wordpress.org/browser/shopengine/tags/4.9.4/core/export-import/import.php#L45
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4045d49f-fd12-4906-9e60-97fdb082fe84?source=cve
