CVE-2026-18789 — Ezoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes

CVE-2026-18789

Ezoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes PUBLISHED

Description (CNA)

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently change some of its settings.

Affected (CNA)

Vendor / product	Versions
Unknown / Ezoic	affected 2.6.35 before 2.23.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/1e2ce237-dc91-4144-875a-339b5ea05f3a/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.