CVE-2026-14229 — ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload

CVE-2026-14229

ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload PUBLISHED

Description (CNA)

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished (private, draft, pending) documents by supplying their identifier.

Affected (CNA)

Vendor / product	Versions
Unknown / ECS	affected 0 before 4.3.8

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/52b44fc8-90af-45e4-a745-37e6369d8b6b/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.