Privilege Escalation in Ecwid by Lightspeed Ecommerce Shopping Cart for WordPress

CVE-2026-1750

What is CVE-2026-1750?

The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress contains a vulnerability that allows authenticated attackers to escalate their privileges. Specifically, the issue arises from a lack of proper capability checks in the 'save_custom_user_profile_fields' function. This flaw allows users with minimal permissions, such as subscribers, to manipulate the 'ec_store_admin_access' parameter during a profile update, potentially granting them store manager access. Website administrators should take immediate action to update their plugins to safeguard against this type of unauthorized access.

References