CVE-2026-18807

EUVD-2026-59592 · Published Aug 15, 2026

The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding configuration of posts they do not own and to change the ECS WordPress plugin before 4.3.8's site-wide presets.

Weaknesses

CWE-862

CVSS scores

v3.14.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Persistence Stealth Defense Impairment Credential Access

T1190Exploit Public-Facing Application T1211Exploitation for Stealth T1542.002Component Firmware T1556Modify Authentication Process

References

https://wpscan.com/vulnerability/bf500bf2-1684-4ca1-a8ad-bcff9cbc127c/

Potentially impacted assets

See if this affects your attack surface