EUVD-2026-57746
GHSA-qh25-wx59-wwwv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
PR:L confirmed by subscriber-level requirement; AV:N and AC:L as the endpoint is network-reachable with no special conditions; C:N because no data is disclosed; I:L and A:L for store disconnection impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an administrator reconnects it.
AnalysisAI
Broken authorization in the Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin (versions before 7.0.9) allows any authenticated WordPress user - including the lowest-privilege subscriber role - to disconnect the site's Ecwid store and take the entire storefront offline. The affected store-management action performs neither a capability check nor a nonce verification, meaning the only barrier to exploitation is a valid WordPress session. A public exploit exists per WPScan reporting, and the fix is confirmed available in version 7.0.9.
Technical ContextAI
The vulnerability resides in a store-management AJAX or admin action registered by the Ecwid by Lightspeed plugin within WordPress. WordPress expects privileged actions to be gated by current_user_can() capability checks (e.g., manage_options or a plugin-specific capability) and protected against CSRF via wp_verify_nonce(). The affected action omits both controls entirely, meaning any authenticated HTTP request - regardless of the requester's role - can trigger store disconnection. The CPE cpe:2.3:a:unknown:ecwid_by_lightspeed_ecommerce_shopping_cart:*:*:*:*:*:*:*:* covers all versions prior to 7.0.9. Although NVD has not assigned a formal CWE, the root cause maps to CWE-862 (Missing Authorization) with a secondary element of CWE-352 (Cross-Site Request Forgery) given the absent nonce check.
RemediationAI
Update the Ecwid by Lightspeed Ecommerce Shopping Cart plugin to version 7.0.9 or later immediately; this is the only confirmed fix and addresses both the missing capability check and the absent nonce verification. The WPScan advisory at https://wpscan.com/vulnerability/75182c5d-c7f5-4da9-bffd-1f7bf54cfd04/ provides additional context. As a compensating control before patching, disable open user registration on the WordPress site (Settings > General, uncheck 'Anyone can register') to prevent unauthenticated outsiders from self-creating subscriber accounts. Note that this workaround does not protect against existing subscriber-level accounts, compromised credentials, or sites where registration must remain open; it only raises the bar for external opportunistic attackers. No workaround eliminates the underlying flaw - patching to 7.0.9 is mandatory.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today