CVE-2026-14332
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before version 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions. This allows any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an administrator reconnects it.
Risk Assessment
An attacker can intentionally take the online store offline, causing business disruption and revenue loss. This requires an authenticated account, even with low privileges.
Recommendation
Update the Ecwid plugin to version 7.0.9 or later, which includes the fix. Additionally, limit the number of user accounts and regularly audit permissions.
Original NVD description (English source)
The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an administrator reconnects it.