CVE-2026-75971

Executive Summary

CVE-2026-75971 is a privilege escalation vulnerability in the ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress, affecting all versions up to and including 4.9.4. The flaw allows authenticated attackers with Shop Manager-level access or above to write arbitrary WordPress options by abusing the WordPress Importer flow, potentially enabling self-registration of Administrator accounts and resulting in complete site takeover. The vulnerability is currently unpatched, with no vendor fix, workaround, or public exploit code available as of this writing; the CVSS 3.1 base score is 7.2 (High), reflecting the high impact on confidentiality, integrity, and availability.

Technical Analysis

The ShopEngine plugin registers a function named rum_importer() on the WordPress core import_start action hook. This action hook is fired by the WordPress Importer when an import operation begins. The critical flaw is twofold:

1. Missing Capability Check: The registration of rum_importer() on the import_start hook occurs without any plugin-owned capability check. The plugin's developer either assumed the hook is only reachable by administrators or failed to implement an explicit permission gate on the hook callback. In practice, WordPress delegates the import capability to the shop_manager role via WooCommerce's role definitions. This means a user with Shop Manager role — which is typically a non-administrative, store-management role — can trigger the WordPress Importer flow and hence the import_start hook.

2. No Allowlist Filtering: The rum_importer() function parses arbitrary <wp_option> name/value pairs from an attacker-supplied WXR (WordPress eXtended RSS) import file and passes them directly to update_option(). There is no allowlist restricting which option names can be modified. This is a classic "arbitrary options update" vulnerability pattern that has been seen in multiple WordPress plugins historically.

The attack mechanism is a two-stage chain:

• Stage 1 — Trigger the hook: An authenticated attacker with Shop Manager access navigates to the WordPress Importer (Tools → Import → WordPress). The Importer accepts a WXR file. Uploading a malicious WXR file causes the importer to parse it, and during parsing the import_start hook fires.

• Stage 2 — Write malicious options: The attacker embeds crafted <wp_option> elements in the WXR file. These elements contain a <name> tag (the option key) and a <value> tag (the serialized value). The rum_importer() callback reads these pairs and invokes update_option($name, $value). By supplying:

  • users_can_register = 1 — enables open user registration on the WordPress site.
  • default_role = administrator — sets the default role for newly registered users to Administrator.

Once both options are set, any unauthenticated visitor can register an account on the site, and the account will be granted the administrator role automatically. This results in full site compromise, including the ability to upload plugins/themes (and thus PHP webshells), alter all content, modify other users, and access the WordPress database.

The vulnerability is classified as CWE-269 (Improper Privilege Management) because the core flaw is the absence of a capability check before performing a privileged operation (writing WordPress options). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H reflects that while high privileges (Shop Manager) are required, the attack requires no user interaction, the network attack surface is remote, the attack complexity is low, and the impact on confidentiality, integrity, and availability is each rated High.

Exploitation Scenarios

Scenario: Site Takeover via Malicious WXR Import

Step 1 — Reconnaissance / Target Identification:
An attacker first identifies WordPress sites running the ShopEngine plugin version 4.9.4 or earlier. This can be done via:

• Shodan/Censys searches for WordPress installations (http.title:"ShopEngine").
• WordPress plugin version disclosure via DO NOT "readme.html", "changelog.txt", or the ?p=1&preview=true trick in older releases.
• WPScan or similar enumeration tools.
• Checking the site's source HTML for wp-content/plugins/shopengine/ path references.

Step 2 — Privilege Acquisition:
The attacker must obtain valid credentials for a user with at least Shop Manager role. This could be obtained through:

• Purchasing/store-employee credentials from a leak.
• Weak-password brute-force against the wp-login.php login form for non-admin users.
• Social engineering targeting store managers.
• A prior lower-severity vulnerability that allows account compromise.

Alternatively, if the attacker is a malicious insider (e.g., a disgruntled employee with Shop Manager access), this step is trivial.

Step 3 — Uploading the Malicious WXR File:
The attacker logs in as the Shop Manager user and navigates to wp-admin/import.php. They select "WordPress" as the import source and upload a crafted .xml (WXR format) file. The WXR file is structured to include <wp_option> elements. Example conceptual structure (illustrative, not actual payload code):

<wp:option>
  <wp:name>users_can_register</wp:name>
  <wp:value>1</wp:value>
</wp:option>
<wp:option>
  <wp:name>default_role</wp:name>
  <wp:value>administrator</wp:value>
</wp:option>

Upon upload, the WordPress Importer processes the file. When it reaches the options section, the import_start hook fires and rum_importer() is invoked. The function extracts each option name/value pair and passes them to update_option(), which writes them to the wp_options table.

The attacker may need to embed additional valid WXR boilerplate (channel metadata, a valid post, etc.) to get the importer past its initial validation. Since no specific WXR parsing logic details are provided in the NVD description, the attack chain at the vulnerability-class level is: craft a WXR file that passes importer validation while embedding malicious option pairs.

Step 4 — Post-Exploitation:
With users_can_register=1 and default_role=administrator, the attacker (or any third party) visits wp-login.php?action=register, creates a new account, and is immediately granted Administrator privileges. The attacker then:

• Uploads a malicious plugin/theme containing a PHP web shell.
• Achieves remote code execution (RCE) on the underlying server.
• Exfiltrates the full database, customer PII, payment records (if stored).
• Installs backdoors for persistence.
• Defaces the site, or uses it as a pivot for attacks on the hosting infrastructure.

Because the vulnerability requires no user interaction and the network attack complexity is low, the exploitation window is short once credentials are obtained.

Note: No public PoC is available for this vulnerability. The attack chain described above is inferred strictly from the NVD description's mechanism (WXR import → import_start hook → rum_importer() → update_option() with arbitrary pairs). The ability to register arbitrary <wp_option> elements is a documented feature of the WXR format, and the WordPress Importer does parse these elements, which aligns with the described flaw. Specific WXR namespace details or exact plugin code paths beyond rum_importer() are not available in public sources at this time.

Impact Assessment

Business Impact:
Full WordPress site compromise leads to total loss of confidentiality, integrity, and availability for the affected website. For WooCommerce stores, this is particularly severe:

• Customer Data Breach: WooCommerce stores handle customer PII (names, addresses, emails, phone numbers), order histories, and in many configurations, payment card data (if not fully offloaded to a PCI-validated payment gateway). Full Administrator access enables attackers to dump the entire database.
• Financial Fraud: Attackers can modify product prices, inject malicious checkout code to skim payment credentials, or redirect payments to attacker-controlled accounts.
• Reputation Damage: Site defacement, malicious content injection, or SEO poisoning directly harms brand trust.
• Supply-Chain Risk: Compromised WordPress sites have been historically used to distribute malware to visitors (drive-by downloads) or to send phishing emails.

Affected Systems:
All WordPress sites running the ShopEngine plugin version ≤ 4.9.4. The plugin is an add-on for Elementor/WooCommerce, so sites must have both Elementor and WooCommerce installed. The attack surface is limited to sites where a user with shop_manager role exists — which is standard in any multi-user WooCommerce store with staff.

Blast Radius:
CVSS 3.1 base score 7.2 with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The scope is unchanged (U), meaning the compromise is confined to the WordPress application itself and its underlying host via webshell — no adjacent systems are directly reachable, but any connected services (database, object storage, API keys in wp-config.php) become accessible. The confidentiality and integrity impacts are High, and availability impact is also High because the attacker can deface or take the site offline. The requirement for shop_manager privileges (High) lowers the score from critical, but the privilege escalation to Administrator effectively negates that constraint in real-world terms.

Exploit Maturity:
No public exploit code, Nuclei template, or PoC is available. However, the vulnerability class (WXR import → options update) has been publicly discussed in the WordPress security research community since at least 2019. The required payload is simple — a WXR file with crafted option tags — and any competent WordPress security researcher or penetration tester can craft it within hours. The absence of a public PoC likely reflects the vulnerability's recent disclosure, not its difficulty.

Detection Guidance

Sigma Rule

title: Suspicious WordPress WXR Import with Arbitrary Option Update
id: 2c4f5a1e-77b9-4d8e-9ad3-5e17d6b2c1f0
status: experimental
description: Detects upload of WordPress WXR import files containing wp_option elements targeting users_can_register or default_role, indicative of CVE-2026-75971 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-75971
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    product: wordpress
    service: web
detection:
    selection_wxr_file:
        event.action|contains: import
        file.name|endswith:
            - .xml
            - .wxr
    selection_malicious_options:
        file.content|contains|all:
            - 'wp:option'
            - 'users_can_register'
            - 'administrator'
        file.content|contains|all:
            - 'wp:option'
            - 'default_role'
    condition: selection_wxr_file and selection_malicious_options
level: high
falsepositives:
    - Legitimate site migration that intentionally changes registration settings (rare)
tags:
    - attack.t1068
    - cve.2026-75971

YARA Rule

rule WP_EXPLOIT_ShopEngine_PrivEsc_WXR
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects WXR import files containing arbitrary option updates targeting registration settings, indicative of CVE-2026-75971"
        date = "2026-01-15"
        cve = "CVE-2026-75971"
        severity = "high"
    strings:
        $s1 = "<wp:option>" ascii wide
        $s2 = "users_can_register" ascii wide
        $s3 = "default_role" ascii wide
        $s4 = "administrator" ascii wide ascii
        $s5 = "<wp:name>" ascii wide
        $s6 = "<wp:value>" ascii wide
    condition:
        uint16(0) == 0x3C3C and  // "<<"
        filesize < 10MB and
        $s1 and $s5 and $s6 and
        (($s2 and $s4) or ($s3 and $s4))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS WooCommerce ShopEngine WXR Import Privilege Escalation Attempt (CVE-2026-75971)"; flow:established,to_server; content:"import.php"; http.uri; content:"POST"; http.method; content:"multipart/form-data"; http.header; pcre:"/name=.?wp:option/i"; pcre:"/(users_can_register|default_role).{0,2048}administrator/is"; sid:7000001; rev:1; reference:cve,2026-75971; classtype:attempted-admin;)

Note: This rule inspects HTTP POST uploads to import.php containing WXR multipart data with suspicious option content. It may require tuning depending on the web server/proxy configuration (e.g., mod_security stripping, reverse proxies buffering uploads).

Elastic Detection

sequence by host.name with maxspan=5m
  [ process where event.action == "file-create" and
    file.extension in ("xml", "wxr") and
    process.name : ("php*", "apache*", "nginx*", "wp-cron*") and
    file.path : "*import*" ]
  [ network where event.action in ("http-request", "http-response") and
    url.path : "*import.php*" and
    http.request.method == "POST" and
    user.name : ("*shop*", "*manager*") ]

This EQL rule looks for a file creation of an XML/WXR import file followed shortly by an HTTP POST to import.php from an account with "shop" or "manager" in the username. Detection of the actual malicious option payload requires HTTP body inspection, which is not natively available in EQL — correlating with auditd/file integrity data is recommended.

Splunk SPL Query

index=web sourcetype=access_combined status=200 uri="/wp-admin/import.php" method=POST
| rex field=uri_path "/(?<wp_path>.*)"
| search wp_path=import.php
| join type=inner host [ search index=filesys sourcetype=fschange | where file_name LIKE "%.xml" OR file_name LIKE "%.wxr" ]
| eval malicious_opts=if(lower(file_contents) LIKE "%users_can_register%" OR lower(file_contents) LIKE "%default_role%", 1, 0)
| where malicious_opts=1
| stats count by src_ip, user, host, _time
| sort - _time

This query correlates HTTP POST access to wp-admin/import.php with filesystem events showing XML/WXR file uploads, then flags files containing the sensitive option name strings. Adjust index/sourcetype names per your environment.

Wazuh OSSEC Rule

<group name="wordpress,shopengine,cve_2026_75971,">
  <rule id="100501" level="12">
    <decoded>wp-admin/import.php</decoded>
    <field name="http_method">POST</field>
    <match>multipart/form-data</match>
    <regex>wp:option.*users_can_register.*administrator</regex>
    <description>ShopEngine CVE-2026-75971: Malicious WXR import detected containing users_can_register=administrator</description>
    <group>attack.t1068,pci_dss_6.5.5,gdpr_32,</group>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
  <rule id="100502" level="12">
    <decoded>wp-admin/import.php</decoded>
    <field name="http_method">POST</field>
    <match>multipart/form-data</match>
    <regex>wp:option.*default_role.*administrator</regex>
    <description>ShopEngine CVE-2026-75971: Malicious WXR import detected containing default_role=administrator</description>
    <group>attack.t1068,pci_dss_6.5.5,gdpr_32,</group>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

These rules require Wazuh to be able to inspect HTTP POST body content, which typically requires a web proxy or WAF feeding logs into Wazuh.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source exists at the time of this writing. The vendor has not released a fixed version, an advisory, or a workaround. Affected versions: all versions up to and including 4.9.4.

1. Immediate Mitigations

• Disable the WordPress Importer: Restrict access to the /wp-admin/import.php endpoint. This can be done via:
  • .htaccess rules blocking import.php for non-admin users.
  • A Wordfence or similar WAF rule denying access to import.php for users whose role is not Administrator.
  • A custom functions.php snippet: add_action('admin_init', function(){ if(current_user_can('manage_options') === false && strpos($_SERVER['REQUEST_URI'], 'import.php') !== false) { wp_die('Access denied'); } });
  • Caution: Disabling the importer blocks legitimate site migrations. Weigh the trade-off.
• Audit user roles: Immediately review all shop_manager users. If any are not actively needed, demote or remove them. Ensure strong passwords/MFA for all remaining Shop Manager accounts.
• Restrict WXR uploads: If possible, intercept and inspect any .xml/.wxr upload at the web server level and block files containing <wp:option> elements unless the import is explicitly authorized.
• Monitor WordPress options: Deploy a monitoring alert that fires whenever the users_can_register or default_role options change. Tripwire-style integrity monitoring on the wp_options table is recommended.

2. Patch/Upgrade Steps

• Check for vendor updates on the ShopEngine plugin page (both official WordPress.org repository and the vendor's site, shopengine.xyz) on a daily basis. As of this report, no fixed version exists.
• When a fixed version (e.g., 4.9.5 or later) is released, update immediately.
• If the plugin is no longer maintained, strongly consider finding an alternative WooCommerce/Elementor builder solution and deactivating ShopEngine entirely.

3. Long-Term Hardening

• Capability hardening: Leverage a plugin like WPSEC (WordPress Security) or a custom capability map to remove the import capability from the shop_manager role. This directly breaks the attack chain. WooCommerce assigns the import capability to Shop Managers by default; tools such as User Role Editor can revoke it.
• Principle of least privilege: Audit all custom roles regularly. Review role definitions after every WooCommerce/Elementor/ShopEngine update, as updates may re-add capabilities.
• Web Application Firewall (WAF): Deploy a WAF (Cloudflare, Sucuri, AWS WAF) with rules to inspect POST body content for suspicious WXR option patterns matching the YARA rule above.
• File integrity monitoring: Implement OSSEC/Wazuh or Tripwire to monitor changes to the wp_options table and any new files in the uploads directory.
• Regular backups: Maintain daily off-site backups with defined RPO/RTO. Test restoration procedures quarterly.
• Update policy: Maintain a 48-hour SLA for security patches to all WordPress plugins, including this one once it is patched.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-75971 — Official NVD record with the CVE description, CVSS score, and CWE classification.

2. Vendor Advisory (Status: None): No vendor advisory exists at this time. The vendor (ShopEngine, shopengine.xyz) has not published any security announcement, patch, or workaround. Monitoring of the vendor's site and WordPress.org plugin update feed is recommended.

3. WordPress Importer Documentation: https://developer.wordpress.org/plugins/wordpress-importer/ — Official WordPress documentation covering the importer flow, including the import_start hook and the WXR file format. This is the authoritative reference for understanding the attack mechanism.

4. WooCommerce Role/Capability Reference: https://woocommerce.com/document/roles-capabilities/ — WooCommerce documentation confirming that the shop_manager role is granted the import capability, which is the root cause of the privilege escalation chain.

5. CISA KEV (Known Exploited Vulnerabilities): This CVE is NOT listed on the CISA KEV catalog as of this report. No threat-actor campaigns or exploitations-in-the-wild have been publicly documented. EPSS has not yet assigned a score. Organizations should nevertheless treat this as high-priority given the trivial exploitability once Shop Manager credentials are obtained.