6.5
Moyenne
CVE-2026-19613 The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic…
Description
The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post metadata from posts they do not own, including private and draft ones.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| ECS 4.3 | premières → < 4.3.10 | 4.3.10 |
Autres CVE de ECS
Les 4 CVE de ECS →
CVE-2026-18807
The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions,…
4.3
Moyenne
CVE-2026-14230
The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater…
5.4
Moyenne
CVE-2026-14229
The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor…
5.3
Moyenne