The Ecwid by Lightspeed Ecommerce Shopping Cart plugin fails to verify permissions and nonce for the store‑management "ec_disconnect" action before version 7.0.9. Because of this omission any authenticated user, such as a subscriber role, can invoke the action and force the store offline until an administrator reconnects it. This bug is an instance of improper access control and effectively causes a denial of service by taking the storefront offline, with a CVSS score of 5.4 indicating moderate severity.

Versions of the Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 are impacted. The fault exists in the plugin code that handles the "ec_disconnect" command and applies to all installations using these affected releases.

Attackers need authenticated access to an account with subscriber role to trigger the flaw. The vulnerability does not require elevated privileges, but it bypasses normal capability checks, allowing any logged‑in subscriber to disconnect the store. The flaw permits the store to be taken offline until an administrator reconnects it. The EPSS score is <1% and the vulnerability is not listed in CISA KEV, indicating a moderate risk level.