ECPay Ecommerce CVE-2026-32578

Requires an authenticated low-privilege WordPress account at Subscriber level (CVSS PR:L) on a site running ECPay Ecommerce for WooCommerce version 1.1.2606090 or earlier. Practical exploitability is greatly increased on stores that permit open customer/subscriber self-registration (the default for most WooCommerce shops), which lets an attacker obtain the needed account at will; sites that disable public registration substantially limit exposure. No user interaction (UI:N) and no non-default feature toggle are indicated in the description. Limiting factors: a valid subscriber session is mandatory, confidentiality is unaffected (C:N), and the specific privileged action abused is not detailed in the available data.

This is a moderate-severity, authenticated access-control flaw (CWE-862, Missing Authorization) rather than a high-priority emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H = 7.1) indicates a network-reachable, low-complexity attack requiring low-level privileges (PR:L - consistent with the 'Subscriber' role named in the title), with no confidentiality impact, limited integrity impact, and high availability impact. The PR:L requirement is the single most important risk-limiting factor: an attacker must already hold a valid low-privilege (subscriber) account on the target WordPress site, so this is not a pre-auth mass-exploitation bug. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no public exploit identified at time of analysis - this contrasts sharply with the 7.1 CVSS and argues against treating it as an immediate, widely-exploited threat. The A:H (high availability) rating is somewhat unusual for a broken-access-control/missing-authorization issue and is not substantiated by the one-line description; this should be verified with Patchstack/the vendor, as the availability impact may be overstated. Overall: patch in normal cycle, with elevated urgency only on sites that allow open subscriber/customer registration (common for WooCommerce stores).

An attacker registers a free subscriber/customer account on a WooCommerce store running ECPay Ecommerce for WooCommerce <= 1.1.2606090 - trivial where open registration is enabled. Using that authenticated session, they invoke a plugin endpoint or action that fails to check the caller's authorization (CWE-862), performing an operation intended for higher-privileged users. No public exploit code was identified at time of analysis, and low attack complexity (AC:L) means no special timing or conditions are needed once a subscriber account is held.