CVE-2026-75971: CWE-269 Improper Privilege Management in roxnor ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets

CVE-2026-75971 is a privilege escalation vulnerability in the ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress, affecting all versions up to and including 4.9.4. The vulnerability is due to the `rum_importer()` function being registered on the WordPress core `import_start` hook without plugin-owned capability checks or allowlist filtering. This allows authenticated users with Shop Manager-level permissions, who have the `import` capability granted by WooCommerce, to pass arbitrary option name/value pairs from a crafted WXR import file directly to `update_option()`. Exploitation can lead to setting critical options like `users_can_register` and `default_role` to enable open registration of administrator accounts, resulting in full site compromise.

An attacker with Shop Manager-level access can escalate privileges to administrator by exploiting the lack of capability checks in the import process. This allows arbitrary modification of WordPress options, including enabling open registration and setting the default user role to administrator, effectively allowing full site takeover. The vulnerability has a CVSS v3.1 score of 7.2 (high severity), indicating a significant impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Shop Manager-level user permissions to prevent access to the import functionality or disable the vulnerable plugin if possible. Monitor for vendor updates and apply patches promptly once released.