blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-18807

MEDIUM 4.3 CVSS 3.1
Published
August 15, 2026
Last modified
October 16, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding configuration of posts they do not own and to change the ECS WordPress plugin before 4.3.13's site-wide presets.

Affected products and versions

  • Unknown ECS — Before 4.3.13

References

  • wpscan.com https://wpscan.com/vulnerability/bf500bf2-1684-4ca1-a8ad-bcff9cbc127c/
  • nvd.nist.gov Official NVD record