EUVD-2026-59587
GHSA-phww-7g4v-vrwj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network AJAX endpoint requires no credentials or interaction; confidentiality limited to partial draft content disclosure with no integrity or availability impact.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished (private, draft, pending) documents by supplying their identifier.
AnalysisAI
Unauthorized disclosure of unpublished Elementor content affects the ECS WordPress plugin before version 4.3.8, allowing any unauthenticated internet user to retrieve the fully rendered HTML of private, draft, or pending Elementor documents by supplying a valid post identifier to a plugin AJAX endpoint. The plugin's AJAX handler for rendering Elementor documents performs no post-status check and enforces no WordPress capability, completely bypassing the platform's native visibility controls for those requests. No public exploit code has been identified and EPSS is 0.15% (5th percentile), indicating low observed exploitation probability, though the zero-authentication requirement makes the attack trivially automatable against enumerable sequential post IDs.
Technical ContextAI
The ECS plugin extends Elementor's visual page-builder within WordPress, exposing AJAX actions (processed through wp-admin/admin-ajax.php) that trigger server-side rendering of Elementor document templates. The root cause is CWE-284 (Improper Access Control): the AJAX handler responsible for rendering these documents omits both a get_post_status() check and a current_user_can() capability verification before returning content. WordPress's post-visibility model (published, private, draft, pending, password-protected) is entirely honoured by core REST and query APIs but must be explicitly enforced by plugin code in custom AJAX handlers - the ECS plugin fails to do this. Because WordPress post IDs are sequential integers assigned at creation time, an attacker can enumerate them without prior knowledge. No CPE string was included in the available intelligence; the affected version range is documented by EUVD-2026-59587 as 'ECS 0 <4.3.8' and corroborated by the WPScan advisory.
RemediationAI
Update the ECS WordPress plugin to version 4.3.8 or later, which introduces proper post-status and capability verification in the affected AJAX handler; this is the only confirmed fix per the WPScan advisory (https://wpscan.com/vulnerability/52b44fc8-90af-45e4-a745-37e6369d8b6b/) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-14229). The exact patched version (4.3.8) is confirmed by vendor advisory. If immediate upgrade is operationally blocked, a targeted compensating control is to restrict unauthenticated POST requests to wp-admin/admin-ajax.php at the web server or WAF layer for the specific ECS action parameter - note this may break legitimate frontend AJAX functionality for logged-out users and requires identifying the specific action name from the plugin source before applying. A lighter-weight interim measure is to audit and remove any sensitive content currently stored in draft or private Elementor posts on affected installations, reducing the blast radius of exploitation until the patch can be applied.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today