CVE-2026-14332: 
WordPress vulnerability analysis and mitigation

CVE-2026-14332 is a missing authorization vulnerability in the Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin that allows any authenticated user (subscriber-level or higher) to disconnect the store and take the storefront offline. The affected versions are all releases before 7.0.9. It was publicly disclosed on August 11, 2026, with the CVE published on August 13, 2026. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium), assigned by WPScan (WPScan, GitHub Advisory).

The root cause is a missing authorization check (CWE-862) combined with absent nonce verification on the plugin's ec_disconnect store-management action. Because WordPress does not enforce capability checks on this AJAX action, any authenticated user — including those with only subscriber-level privileges — can trigger the action over the network without any additional preconditions beyond having a valid WordPress account. The vulnerability was discovered and reported by researcher Alexander Jurkschat (WPScan). A proof-of-concept is scheduled for public release on August 25, 2026, to allow time for users to update (WPScan).

Successful exploitation allows any authenticated WordPress user to disconnect the Ecwid store integration, rendering the storefront completely offline and unavailable to customers until an administrator manually reconnects it. This results in a low integrity impact (unauthorized store-management action) and a low availability impact (storefront disruption), with no confidentiality impact. For e-commerce sites, even temporary storefront downtime can result in direct revenue loss and reputational damage (GitHub Advisory, WPScan).

There is currently no public proof-of-concept exploit available, though WPScan has indicated a PoC will be published on August 25, 2026. There is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The low barrier to exploitation — requiring only a valid WordPress subscriber account — makes it a realistic threat for sites with open user registration (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the Ecwid by Lightspeed Ecommerce Shopping Cart plugin in a version prior to 7.0.9, using tools like WPScan or by inspecting plugin metadata in page source.
2. Obtain authentication: Register or log in as any authenticated WordPress user (subscriber-level access is sufficient); sites with open user registration are particularly exposed.
3. Trigger the vulnerable action: Send an authenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to ec_disconnect (or the equivalent store-management action), bypassing the missing capability check and nonce verification.
4. Achieve impact: The store is disconnected from the Ecwid backend, taking the storefront offline. The site remains non-functional for customers until an administrator logs in and manually reconnects the store (WPScan).

• Logs: WordPress access logs showing POST requests to /wp-admin/admin-ajax.php with action=ec_disconnect (or equivalent store-management action) originating from low-privileged user accounts.
• Application Behavior: Sudden storefront unavailability or Ecwid store disconnection without administrator action; admin dashboard showing the store as disconnected.
• Logs: WordPress authentication logs showing subscriber-level accounts logging in shortly before the store disconnection event.

Update the Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin to version 7.0.9 or later, which introduces proper capability checks and nonce verification on store-management actions (WPScan). As interim measures, restrict WordPress user registration to trusted individuals only, audit existing subscriber-level accounts, and consider deploying a Web Application Firewall (WAF) rule to block unauthorized requests to the ec_disconnect action endpoint.