Unauthorized Store Disconnection in Ecwid by Lightspeed WordPress Plugin

Executive Summary

This vulnerability affects the Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before version 7.0.9. It involves insufficient capability checks and missing nonce verification in the 'ec_disconnect' action. This allows any authenticated user, including low-privilege subscribers, to disconnect the store and take the storefront offline until an administrator reconnects it.

Useful 0 Not Useful 0

Detection Guidance

Check if your WordPress site uses the Ecwid by Lightspeed Ecommerce Shopping Cart plugin version prior to 7.0.9. You can do this by running the command: wp plugin list | grep ecwid_ecommerce_shopping_cart in your WordPress installation directory. If the version is below 7.0.9, the site is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to disrupt your online store by disconnecting it, making it inaccessible to customers. This downtime persists until an admin manually reconnects the store, potentially causing loss of sales, reputation damage, and operational disruption.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Ecwid by Lightspeed Ecommerce Shopping Cart plugin to version 7.0.9 or later. This can be done via the WordPress admin dashboard under Plugins or by running the command: wp plugin update ecwid_ecommerce_shopping_cart in your WordPress installation directory.

Useful 0 Not Useful 0