EUVD-2026-59592
GHSA-qp7g-pcqj-v98x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
PR:L confirmed by contributor requirement; C:L added because description explicitly includes read access to others' configurations, contradicting NVD's C:N.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding configuration of posts they do not own and to change the ECS WordPress plugin before 4.3.8's site-wide presets.
AnalysisAI
Missing authorization on ECS WordPress plugin's dynamic repeater actions (versions before 4.3.8) allows any contributor-level account or above to read, alter, and delete binding configurations of posts they do not own, and to overwrite site-wide plugin presets. The plugin relies solely on a nonce for these actions - a token available to anyone who can open the page builder - without performing capability or ownership checks (CWE-862). No public exploit has been identified at time of analysis, and the EPSS score of 0.13% (3rd percentile) indicates very low current exploitation probability; however, the attack requires only a standard contributor account, making multi-author WordPress sites the primary risk surface.
Technical ContextAI
The ECS WordPress plugin implements a 'dynamic repeater' feature within its page builder that controls post binding configurations and site-wide presets. In WordPress, nonces are anti-CSRF tokens scoped to a user session - they confirm that a request originates from the authenticated session but do not enforce role-based access control or resource ownership. The vulnerable action handlers validate only this nonce, omitting the standard WordPress authorization primitives such as current_user_can() capability checks and post author/ownership verification. This is a textbook CWE-862 (Missing Authorization) flaw: the system authenticates the request origin but fails to authorize whether the caller has rights over the targeted resource. The contributor role in WordPress is the lowest role permitted to create and submit posts; it is routinely granted to guest authors and external contributors, making the trust boundary meaningful. Affected versions span all ECS releases from 0 up to but not including 4.3.8, per EUVD-2026-59592.
RemediationAI
Update the ECS WordPress plugin to version 4.3.8 or later, which the vendor confirms resolves the missing authorization checks on dynamic repeater actions. The patch is confirmed available per the WPScan advisory (https://wpscan.com/vulnerability/bf500bf2-1684-4ca1-a8ad-bcff9cbc127c/) and EUVD-2026-59592; the exact fix version 4.3.8 is derived from the confirmed affected range. As a compensating control prior to patching, administrators should audit and restrict contributor-level accounts - removing contributor roles from untrusted or external users eliminates exploitation risk entirely, though this may disrupt editorial workflows on multi-author sites. Restricting access to the ECS page builder to Editor or Administrator roles only would also eliminate the attack surface, as the vulnerable nonce is only issued to users who can open the builder. There is no configuration-only fix; the nonce-reliance flaw requires a code-level patch.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today