The vulnerability arises from a missing capability check in the save_custom_user_profile_fields function. Authenticated users with minimal permissions, such as subscribers, can supply the ec_store_admin_access parameter during a profile update, which grants them store manager privileges. The flaw is a classic privilege escalation issue, classified as CWE-269, allowing a low‑privilege user to gain higher‑level control over the e‑commerce platform.

Affected systems are installations of the Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin through version 7.0.7 inclusive. All WordPress sites running any of these versions are susceptible until the plugin is updated to a fixed release.

The severity is high with a CVSS score of 8.8, yet the EPSS score of less than 1% indicates a very low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need an authenticated session and would exploit the profile‑update endpoint to set the ec_store_admin_access flag, thereby escalating privileges. Security teams should treat this as a high‑risk flaw requiring prompt remediation.