The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin contains a privilege escalation vulnerability (CWE-269) due to inadequate privilege management in the 'save_custom_user_profile_fields' function. Authenticated users with low-level permissions can exploit the missing capability check by submitting the 'ec_store_admin_access' parameter when updating their profile, thereby elevating their privileges to store manager level. This vulnerability affects all versions up to and including 7.0.7. The CVSS 3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, and no user interaction required. No patch or remediation details are currently provided.

An attacker with minimal authenticated permissions (e.g., subscriber role) can escalate their privileges to gain store manager access, potentially allowing full control over the ecommerce store functionality within the WordPress site. This can lead to unauthorized changes, data exposure, and disruption of ecommerce operations. The vulnerability has a high CVSS score (8.8) reflecting its critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious privilege changes. Avoid granting unnecessary permissions to low-privilege users. Follow updates from the Ecwid by Lightspeed vendor for any forthcoming patches or official mitigations.