The Ecwid by Lightspeed Ecommerce Shopping Cart plugin fails to verify permissions and the nonce for the store‑management "ec_disconnect" action before version 7.0.9. Because of this omission any authenticated user, such as a subscriber role, can invoke the action and force the store offline until an administrator reconnects it. This bug is an instance of improper access control and effectively causes a denial of service by taking the storefront offline, with a CVSS score of 5.4 indicating moderate severity.

Versions of the Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 are impacted. The fault exists in the plugin code that handles the "ec_disconnect" command and applies to all installations using these affected releases.

Attackers need authenticated access to a subscriber account to trigger the flaw. The vulnerability does not require elevated privileges, but it bypasses normal capability checks, allowing any logged‑in subscriber to disconnect the store. Because the plugin lacks nonce protection, the action is susceptible to CSRF if a malicious site could trick a logged‑in subscriber into visiting a crafted URL. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating a moderate but not catastrophic risk level.