CVE-2026-14332
Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Subscriber+ Store Disconnection via 'ec_disconnect' Action
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an administrator reconnects it.
| Vendor | unknown |
| Product | ecwid by lightspeed ecommerce shopping cart |
| Published | Aug 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown ecwid by lightspeed ecommerce shopping cart
Be the first to know when new medium vulnerabilities affecting unknown ecwid by lightspeed ecommerce shopping cart are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Ecwid by Lightspeed Ecommerce Shopping Cart
0 < 7.0.9
References
Credits
Alexander Jurkschat WPScan