CVE-2026-75971: ShopEngine WooCommerce Privilege Escalation

CVE-2026-75971 Overview

CVE-2026-75971 is a privilege escalation vulnerability in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress. The flaw affects all versions up to and including 4.9.4. Authenticated attackers with Shop Manager-level access can write arbitrary WordPress options through the plugin's WXR import handler. Successful exploitation enables self-registration of Administrator accounts and full site takeover. The vulnerability is categorized under CWE-269: Improper Privilege Management.

Critical Impact
A Shop Manager account can flip users_can_register to 1 and default_role to administrator, allowing anyone to register a new Administrator account and take over the site.

Affected Products

ShopEngine Elementor WooCommerce Builder Addon for WordPress — all versions through 4.9.4
WordPress installations with WooCommerce granting the import capability to the Shop Manager role
Sites exposing the WordPress Importer flow to non-Administrator roles

Discovery Timeline

2026-08-25 - CVE-2026-75971 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75971

Vulnerability Analysis

The vulnerability resides in ShopEngine's export/import subsystem, specifically the rum_importer() function defined in core/export-import/import.php. The plugin registers this callback on the WordPress core import_start action hook without a plugin-owned capability check or allowlist of permitted option names. When a WXR (WordPress eXtended RSS) import runs, rum_importer() iterates over <wp_option> elements from the attacker-supplied file and passes their option_name and option_value pairs directly to update_option().

The plugin author assumed the import_start hook fires only in Administrator contexts. WooCommerce, however, grants the import capability to the Shop Manager role. That role can therefore reach the WordPress Importer flow, trigger import_start, and drive rum_importer() with arbitrary option payloads.

Root Cause

The root cause is missing authorization and missing input allowlisting on a privileged data-write path. The rum_importer() handler trusts both the caller's context and the imported document's contents. No allowlist restricts which WordPress options can be written, so security-critical options such as users_can_register, default_role, siteurl, and home are all reachable.

Attack Vector

An attacker authenticates as a Shop Manager, then uses the WordPress Importer to upload a crafted WXR file. The file contains <wp_option> entries setting users_can_register to 1 and default_role to administrator. When the import starts, rum_importer() writes both values via update_option(). The attacker then browses to /wp-login.php?action=register, registers a new account, and receives Administrator privileges. Full site takeover follows through plugin/theme upload or direct PHP execution.

See the vulnerable source in ShopEngine import.php line 19 and line 45, and the hook registration in base.php line 57.

Detection Methods for CVE-2026-75971

Indicators of Compromise

Unexpected changes to the users_can_register or default_role values in the wp_options table.
New user accounts created via /wp-login.php?action=register shortly after a WXR import event.
Recent uploads under wp-content/uploads/ matching WordPress Importer temp files (*.xml, *.wxr) uploaded by non-Administrator users.
Audit-log entries showing import_start triggered by a Shop Manager account.

Detection Strategies

Review the wp_options table for values of default_role other than subscriber and any state where users_can_register equals 1 on sites that do not intend to allow public registration.
Correlate WordPress user-role assignments with plugin install/activation events and importer runs performed by non-Administrator roles.
Inspect access logs for POST requests to admin.php?import=wordpress originating from Shop Manager sessions.

Monitoring Recommendations

Alert on any modification to authentication-relevant options (users_can_register, default_role, siteurl, home, admin_email).
Monitor for new Administrator account creation and for privilege changes on existing accounts.
Ingest WordPress audit logs into a centralized SIEM to correlate import activity with subsequent registrations and logins.

How to Mitigate CVE-2026-75971

Immediate Actions Required

Update the ShopEngine plugin to a version later than 4.9.4 as soon as the vendor publishes a fixed release.
Audit all Shop Manager, Editor, and custom-role accounts and remove any account that does not require the import capability.
Verify users_can_register is 0 and default_role is subscriber in wp_options, and revert any unauthorized changes.
Rotate credentials for all Administrator accounts and review recently created users.

Patch Information

At the time of NVD publication, all ShopEngine versions through 4.9.4 are vulnerable. Refer to the Wordfence vulnerability report for the current patched version and vendor advisory status. Apply the patched release through the WordPress plugin dashboard or WP-CLI (wp plugin update shopengine).

Workarounds

Remove the import capability from the Shop Manager role until a patched plugin version is installed.
Deactivate the ShopEngine plugin on production sites that cannot immediately apply role restrictions.
Restrict access to wp-admin/admin.php?import=wordpress at the web-server or WAF layer to Administrator IP ranges.
Disable public user registration explicitly by hard-coding define('DISALLOW_FILE_MODS', false) policies and setting users_can_register to 0 via a mu-plugin that overrides update_option for that key.

bash

# Remove the import capability from Shop Manager using WP-CLI
wp cap remove shop_manager import

# Verify current registration-related options
wp option get users_can_register
wp option get default_role

# Force safe values
wp option update users_can_register 0
wp option update default_role subscriber