CVE-2026-18807
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding configuration of posts they do not own and to change the ECS WordPress plugin before 4.3.13's site-wide presets.
Risk Assessment
A low-privileged user (contributor) can modify or delete binding configurations of other users' posts and change site-wide plugin presets, potentially leading to content and site configuration corruption.
Recommendation
Update the ECS plugin to version 4.3.13 or later.
Other vulnerabilities in ECS
Original NVD description (English source)
The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding configuration of posts they do not own and to change the ECS WordPress plugin before 4.3.13's site-wide presets.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS