Ecwid by Lightspeed Ecommerce Shopping Cart <= 7.0.7 - Escalada de privilegios autenticada (Suscriptor+) vía ec_store_admin_access

The primary impact of CVE-2026-1750 is unauthorized privilege escalation. An attacker, initially with limited permissions, can manipulate the 'savecustomuserprofilefields' function by supplying the 'ecstoreadmin_access' parameter during a profile update. This bypasses intended security controls and grants them store manager access, effectively giving them control over critical aspects of the Ecwid store, including product management, order processing, and customer data. This could lead to data breaches, fraudulent transactions, and complete compromise of the e-commerce platform. The ease of exploitation, requiring only authenticated access with subscriber privileges, significantly expands the potential attack surface.

Websites utilizing the Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress, particularly those with a large number of subscriber-level users or those who have not implemented robust user role management practices, are at significant risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise on one site could potentially lead to lateral movement and exploitation of other sites using the vulnerable plugin.

• wordpress / composer / npm:

grep -r 'ec_store_admin_access' /var/www/html/wp-content/plugins/ecwid/includes/user-profile.php

• wordpress / composer / npm:

wp plugin list | grep ecwid

• wordpress / composer / npm:

wp plugin update ecwid

1. 2026-02-15Disclosure

   disclosure

1. Reservado2026-02-02
2. Publicada2026-02-15
3. Modificada2026-04-08
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2026-1750 is to immediately upgrade the Ecwid by Lightspeed Ecommerce Shopping Cart plugin to version 7.0.8 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing stricter user role permissions within WordPress to limit the capabilities of subscriber accounts. While not a complete solution, this can reduce the potential impact. Review WordPress user roles and ensure the 'ecstoreadminaccess' parameter is not accessible to lower-privileged users. After upgrading, confirm the fix by attempting a profile update with a subscriber account and verifying that the 'ecstoreadminaccess' parameter is properly validated and rejected.

Instalaciones activas

20KConocido

Valoración del plugin