Ecwid By Lightspeed Ecommerce Shopping Cart
Monthly
Broken authorization in the Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin (versions before 7.0.9) allows any authenticated WordPress user - including the lowest-privilege subscriber role - to disconnect the site's Ecwid store and take the entire storefront offline. The affected store-management action performs neither a capability check nor a nonce verification, meaning the only barrier to exploitation is a valid WordPress session. A public exploit exists per WPScan reporting, and the fix is confirmed available in version 7.0.9.
Broken authorization in the Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin (versions before 7.0.9) allows any authenticated WordPress user - including the lowest-privilege subscriber role - to disconnect the site's Ecwid store and take the entire storefront offline. The affected store-management action performs neither a capability check nor a nonce verification, meaning the only barrier to exploitation is a valid WordPress session. A public exploit exists per WPScan reporting, and the fix is confirmed available in version 7.0.9.