CVE-2014-4942: The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuratio...

Security readout for executives and security teams

A vulnerable EasyCart WordPress plugin version exposed PHP configuration details through a directly reachable phpinfo page. That information can reveal server paths, modules, and environment details useful for follow-on attacks, but the sources do not show code execution or confirmed active exploitation. Internet-facing WordPress sites running the EasyCart/wp-easycart plugin before 2.0.6 are the likely exposed systems. Exposure is most relevant where the plugin directory is web-accessible and legacy plugin versions remain installed. Treat as a legacy hygiene issue unless evidence shows current exposure. Prioritize remediation on public e-commerce WordPress sites because configuration leakage can support broader compromise chains. Mitigation focus: Inventory WordPress sites for the wp-easycart plugin and installed version.; Upgrade wp-easycart to 2.0.6 or later after checking vendor guidance.; Disable or remove the plugin if it is unused or cannot be upgraded..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.