CVE-2026-14332

Name of the Vulnerable Software and Affected Versions Ecwid by Lightspeed Ecommerce Shopping Cart versions prior to 7.0.9

Description The plugin fails to perform a capability check or nonce verification—a security token used to prevent cross-site request forgery—on a store-management action. This allows any authenticated user, including those with subscriber-level privileges, to trigger the ec disconnect action to disconnect the store and take the storefront offline until an administrator restores the connection.

Recommendations Update to version 7.0.9 or later.