The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin versions prior to 7.0.9 contain a missing authorization vulnerability (CWE-862). Specifically, one of the store-management actions lacks capability checks and nonce verification, enabling any authenticated user to disconnect the store. This results in the storefront being taken offline until an administrator manually reconnects it. The vulnerability has a CVSS 3.1 base score of 5.4, reflecting a medium severity with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact.

An attacker with any authenticated user privileges, such as a subscriber, can exploit this vulnerability to disconnect the store, effectively taking the storefront offline. This causes a denial of service condition impacting the availability of the ecommerce site until an administrator reconnects the store. There is no direct confidentiality impact, but integrity is slightly affected due to unauthorized action execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user roles to trusted users only and monitor for unauthorized store disconnection actions. Administrators should be prepared to promptly reconnect the store if it is taken offline.