This vulnerability is a missing Authorization flaw that lets attackers use incorrectly configured access control security levels within the Ecwid by Lightspeed Ecommerce Shopping Cart plugin. An attacker who can reach routes protected for privileged users—such as product management, payment settings, or store configuration—can perform those operations without proper credentials. The impact includes unauthorized modification or disclosure of store data, potential disruption of e‑commerce operations, and possible fraud.

Affected systems are WordPress sites that have the Ecwid Shopping Cart plugin installed with a version equal to or less than 7.0.6. The plugin is provided by Lightspeed Ecommerce under the product label Ecwid Shopping Cart.

The CVSS base score is 5.3, reflecting moderate potential damage. EPSS indicates a very low exploitation probability (less than 1 %). The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation yet. Attackers can target the plugin over the web interface of a WordPress installation; therefore, the attack vector is likely remote web. The exploit requires reaching the administrative endpoints that are normally restricted, and no special user privileges are needed beforehand since the authorization check is missing.