What the vulnerability does
01Description
The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.0.7. This is due to a missing capability check in the 'save_custom_user_profile_fields' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to supply the 'ec_store_admin_access' parameter during a profile update and gain store manager access to the site.
Explanation of Vulnerability in Simple Terms
02Summary
Ecwid by Lightspeed Ecommerce Shopping Cart versions 7.0.7 and earlier contain a privilege management flaw that allows authenticated users with low-level access to read, modify, or delete sensitive data and functionality. An attacker with a standard user account can escalate their capabilities to perform actions restricted to higher-privilege roles. This affects confidentiality, integrity, and availability of the shopping cart system.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete sensitive data and perform actions normally restricted to higher-privilege accounts.
Potential impact on your site
04Site Impact
Unauthorized users can access customer data, modify product listings, orders, or settings, and disrupt store operations.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege user account on the Ecwid installation.
Key dates
06Disclosure timeline
February 15, 2026
CVE published
April 8, 2026
Record updated
