CVE-2026-24580

Vulnerability

Overview

The Ecwid Shopping Cart plugin for WordPress (versions up to and including 7.0.5) contains a missing authorization vulnerability [1]. The root cause is that certain functions lack proper authorization, authentication, or nonce token checks, allowing users to bypass access control restrictions.

Exploitation

Conditions

An attacker with no or low privileges (e.g., an unauthenticated user or a subscriber) can exploit this broken access control to perform actions that should require higher permissions [1]. This makes the plugin vulnerable to mass-exploit campaigns targeting WordPress sites.

Impact

Successful exploitation enables an unprivileged attacker to execute higher privileged actions, potentially leading to unauthorized data access, modification, or privilege escalation [1]. The CVSS score of 4.3 (Medium) reflects the moderate impact.

Mitigation

Users are strongly advised to update the plugin to version 7.0.6 or later, which resolves the vulnerability [1]. Patchstack users can enable auto-updates for vulnerable plugins.