CVE-2026-19613

The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post metadata from posts they do not own, including private and draft ones.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.27% chance of exploitation in the next 30 days, 19th percentile

Published

2026-08-16

Updated

2026-08-17

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/0d4ccc34-632a-4058-9220-b3cce7a942dd/

References

• CVE Record
• NVD entry

Related

• CVE-2026-19598
• CVE-2026-19615
• CVE-2026-19501
• CVE-2026-19626
• CVE-2026-19500
• CVE-2026-19632