CVE-2026-18807 — ECS < 4.3.13 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers

CVE-2026-18807

ECS < 4.3.13 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers PUBLISHED

Description (CNA)

The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding configuration of posts they do not own and to change the ECS WordPress plugin before 4.3.13's site-wide presets.

Affected (CNA)

Vendor / product	Versions
Unknown / ECS	affected 0 before 4.3.13

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/bf500bf2-1684-4ca1-a8ad-bcff9cbc127c/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.