Skip to content
Sign in
6.5 Medium

CVE-2026-19613 The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic…

Description

The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post metadata from posts they do not own, including private and draft ones.

Affected products and versions

Product Affected versions Fixed in
ECS 4.3 earliest → < 4.3.10 4.3.10

Other CVEs of ECS

The 4 CVEs of ECS →
CVE-2026-18807 The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions,… 4.3 Medium CVE-2026-14230 The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater… 5.4 Medium CVE-2026-14229 The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor… 5.3 Medium
Track this CVE