CVE-2024-13795

The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress through version 6.12.27 contains a cross-site request forgery vulnerability in the ecwid_deactivate_feedback() function due to inadequate nonce verification. An unauthenticated attacker could exploit this flaw to submit deactivation messages impersonating a site administrator if they successfully convince an admin to click a malicious link. The vulnerability affects all versions prior to 6.12.28.

Based on public CVE data (MITRE/NVD).