CVE-2026-1750highCWE-269

CVE-2026-1750: high-severity vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart

Ecwid by Lightspeed Ecommerce Shopping Cart <= 7.0.7 - Authenticated (Subscriber+) Privilege Escalation via ec_store_admin_access

Published · Updated

Follow this CVE+ Monitor Ecwid by Lightspeed Ecommerce Shopping Cart

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.3%
The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.0.7. This is due to a missing capability check in the 'save_custom_user_profile_fields' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to supply the 'ec_store_admin_access' parameter during a profile update and gain store manager access to the site.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
ecwid · Ecwid by Lightspeed Ecommerce Shopping Cart
Related CVEs — Ecwid by Lightspeed Ecommerce Shopping Cart

In the same product, most dangerous first.

CVE-2024-2456MEDIUMEcwid Ecommerce Shopping Cart <= 6.12.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-13795MEDIUMEcwid by Lightspeed Ecommerce Shopping Cart <= 6.12.27 - Cross-Site Request Forgery to Send Deactivation MessageEPSS 0.2%