CVE-2026-75971: ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the rumimporter() function being registered on the WordPress core importstart action hook with no plugin-owned capability check and no allowlist filtering, causing arbitrary <wpoption> name/value pairs parsed from an attacker-supplied WXR import file to be passed directly to updateoption(). This makes it possible for authenticated attackers, with Shop Manager-level access and above, to write arbitrary WordPress options — most critically setting userscanregister to 1 and defaultrole to administrator — enabling open self-registration of Administrator accounts and full site takeover. This is exploitable by Shop Manager-level users because WooCommerce grants that role the import capability, allowing it to reach the WordPress Importer flow that fires the importstart hook on which rumimporter() is registered, contrary to the assumption that the hook is restricted to Administrators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPressto a version that resolves this vulnerability.Fixed in 4.9.4 - Compensating control
Ensure the WordPress `import_start` hook/Import flow is not reachable by Shop Manager+ (e.g., remove or restrict the `import` capability from non-administrator roles), since this vulnerability is exploitable because the Shop Manager role can trigger the WordPress Importer flow that fires `import_start` where `rum_importer()` is registered without a capability check.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated user with the WooCommerce Shop Manager role or a higher-privileged role can exploit it. Shop Managers have the WordPress import capability needed to reach the affected import flow.
What does an attacker need to do to take over a site?
The attacker needs to be able to authenticate as a Shop Manager or higher and supply a crafted WXR import file. They can set WordPress options such as users_can_register=1 and default_role=administrator, then register a new Administrator account.
Are sites affected by the default WooCommerce role configuration?
Yes. The issue is reachable by the standard Shop Manager role because WooCommerce grants that role the import capability; it is not limited to WordPress Administrators.
How can I check whether exploitation may have occurred?
Review the users_can_register and default_role WordPress options for unexpected values, especially users_can_register enabled together with default_role set to administrator. Also investigate recently created Administrator accounts and recent WXR import activity by Shop Manager accounts.