CVE-2026-1750
Published: 15 February 2026
Summary
CVE-2026-1750 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 18.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-1750 is a privilege escalation vulnerability in the Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress, affecting all versions up to and including 7.0.7. The flaw arises from a missing capability check in the `save_custom_user_profile_fields` function, which fails to properly validate user permissions during profile updates.
Authenticated attackers with minimal permissions, such as a subscriber role, can exploit the vulnerability over the network with low complexity and no user interaction required. By supplying the `ec_store_admin_access` parameter during a profile update, they can elevate their privileges to gain store manager access on the site. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is linked to CWE-269 (Improper Privilege Management).
Advisories recommend updating the plugin to a version beyond 7.0.7 to mitigate the issue, with the fix implemented in WordPress plugin changeset 3460721. Further technical details, including the vulnerable code in `class-ec-store-admin-access.php` at line 28, are available via the plugin's Trac repository, while Wordfence provides additional threat intelligence on the vulnerability.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5834
Vulnerability details
The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.0.7. This is due to a missing capability check in the 'save_custom_user_profile_fields' function. This makes it possible for…
more
authenticated attackers, with minimal permissions such as a subscriber, to supply the 'ec_store_admin_access' parameter during a profile update and gain store manager access to the site.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing capability check enables authenticated privilege escalation from low-privileged account (subscriber) to store manager via profile update manipulation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access, directly addressing the missing capability check in the save_custom_user_profile_fields function that allowed privilege escalation.
Employs least privilege to restrict authenticated users like subscribers from gaining unauthorized store manager access via profile updates.
Manages user accounts and role assignments to prevent improper elevation of privileges through manipulated profile parameters.