EasyCommerce – AI-Powered, Blazing-Fast & Beautiful WordPress Ecommerce Plugin 0.9.0-beta2 - 1.8.2 - Unauthenticated Privilege Escalation
Strategic Overview
- Status
- Patched in 1.8.3
- Affected Plugin
- EasyCommerce – Agentic AI Ecommerce & Online Store Builder
- Affected Version
<= 1.8.2- CVSS
- 9.8Critical
- Weakness type
- CWE-269 · Improper Privilege Management
- CVE
CVE-2025-11457
At a glance
CVE-2025-11457 is a critical-severity Improper Privilege Management vulnerability in the EasyCommerce WordPress plugin, affecting versions <= 1.8.2. It carries a CVSS score of 9.8 (reachable over the network; low attack complexity; high confidentiality, integrity, availability impact). Exploitation requires no authentication. The issue is fixed in version 1.8.3; sites on affected versions should update now. Disclosed November 2025, reported by kr0d.
Vulnerability Overview
The EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce Plugin plugin for WordPress is vulnerable to Privilege Escalation in versions 0.9.0-beta2 to 1.8.2. This is due to the /easycommerce/v1/orders REST API endpoint not properly restricting the ability for users to select roles during registration. This makes it possible for unauthenticated attackers to gain administrator-level access to a vulnerable site.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user. A successful exploit has high impact on confidentiality, integrity, availability — full site compromise territory.
CWE-269: Improper Privilege Management
Reaching this weakness in EasyCommerce <= 1.8.2 takes no account at all. Improper privilege management means the code lets an account end up with capabilities its role should not have.
It converts a low-privileged account into an administrative one, which makes every other restriction on the site irrelevant. For EasyCommerce the fix is 1.8.3: builds <= 1.8.2 are affected, anything from 1.8.3 onward is not.
Remediation
Update to version 1.8.3, or a newer patched version
How does WordSec protect against this?
This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: EasyCommerce 1.8.3 closes this, and updating the plugin is the step that ends it.
- Login Security
- Alerts
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C