The vulnerability is an authority flaw that allows an attacker to bypass the access control logic implemented by the Ecwid Shopping Cart plugin. If successfully exploited, an attacker could perform actions or read data on the website that should be restricted to privileged users, potentially modifying orders or sensitive customer information.

The issue affects the Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress, specifically all releases from the earliest versions through 7.0.5. Users running any of these affected versions are at risk until a newer, properly secured release is applied.

The CVSS score of 4.3 denotes a moderate impact, and the EPSS score of less than 1% suggests a very low probability of active exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, indicating it has not yet been publicly exploited. The likely attack vector is through the WordPress site’s administrative interface, where the plugin’s configuration pages can be accessed without sufficient role verification. An attacker with the ability to submit crafted requests or view the affected URLs could exploit the flaw to elevate privileges or extract restricted data.