medium4.3
CVE-2026-18807
The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any u…
Impact
The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding configuration of posts they do not own and to change the ECS WordPress plugin before 4.3.13's site-wide presets.
Affected products
| Product | Affected versions |
|---|---|
| ECS WordPress Plugin | before 4.3.13 |
| Posts They Do Not Own And To Change The ECS WordPress Plugin | before 4.3.13 |
Versions were read from the advisory text. No structured product data has been published for this record yet.