CVE-2026-18807
ECS < 4.3.13 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers
MEDIUM 4.3EPSS 0.3%
The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding configuration of posts they do not own and to change the ECS WordPress plugin before 4.3.8's site-wide presets.
- Affected
- ECS
- CVSS v3.1 CNA
- 4.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - EPSS
- 0.25% chance of exploitation in the next 30 days, 16th percentile
- Published
- 2026-08-15
- Updated
- 2026-10-16