CVE-2015-2673: The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 through 3.0.20 for WordPress allow remote attackers to gain ad

high Affects wp-easycart (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2017-10-06; advisory modified 2026-06-17.

The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 through 3.0.20 for WordPress allow remote attackers to gain ad

Package: wp-easycart (WordPress plugin) WordPress
Affected versions: =1.1.30 or =1.1.31 or =1.1.32 or =1.1.33 or =1.1.34 or =1.1.35 or =1.1.36 or =1.2.0 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.2.6 or =1.2.7 or =1.2.8 or =1.2.9 or =1.2.10 or =1.2.11 or =1.2.12 or =1.2.13 or =1.2.14 or =1.2.15 or =1.2.16 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.0.12 or =2.0.13 or =2.0.14 or =2.0.15 or =2.0.16 or =2.0.17 or =2.0.18 or =2.0.19 or =2.0.20 or =2.0.21 or =2.0.22 or =2.1.0 or =2.1.1 or =2.1.2 or =2.1.3 or =2.1.4 or =2.1.5 or =2.1.6 or =2.1.7 or =2.1.8 or =2.1.9 or =2.1.10 or =2.1.11 or =2.1.12 or =2.1.13 or =2.1.14 or =2.1.15 or =2.1.16 or =2.1.17 or =2.1.18 or =2.1.19 or =2.1.20 or =2.1.21 or =2.1.22 or =2.1.23 or =2.1.24 or =2.1.25 or =2.1.26 or =2.1.27 or =2.1.28 or =2.1.29 or =2.1.30 or =2.1.31 or =2.1.32 or =2.1.33 or =2.1.34 or =2.1.35 or =2.1.36 or =3.0.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.0.7 or =3.0.8 or =3.0.9 or =3.0.10 or =3.0.11 or =3.0.12 or =3.0.13 or =3.0.14 or =3.0.15 or =3.0.16 or =3.0.17 or =3.0.18 or =3.0.19 or =3.0.20
Fixed in: no fix recorded
Severity: high CVSS 8.8
Exploitation: not on CISA KEV · EPSS 19% (97.3th percentile)
Published: 2017-10-06
Source: nvd

References

CWE-264

NVD record wp-easycart (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2014-9308 medium Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.p same package: wp-easycart (WordPress plugin)
CVE-2014-4942 medium The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to ob same package: wp-easycart (WordPress plugin)
CVE-2023-1124 high The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP r same package: wp-easycart (WordPress plugin)
CVE-2023-3023 high The WP EasyCart plugin for WordPress is vulnerable to time-based SQL Injection via the ‘or same package: wp-easycart (WordPress plugin)
CVE-2021-34645 high The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request F same package: wp-easycart (WordPress plugin)
CVE-2023-2891 medium The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versio same package: wp-easycart (WordPress plugin)