EUVD-2026-59913
GHSA-4p53-g645-qhr2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible via HTTP with contributor credentials (PR:L, AC:L); confidentiality impact High because private post meta may contain sensitive data; no integrity or availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post metadata from posts they do not own, including private and draft ones.
AnalysisAI
Missing authorization checks in the ECS WordPress plugin before 4.3.10 allow any contributor-level or higher user to read custom field values and post metadata from WordPress posts they do not own, including private and draft content. The plugin's dynamic repeater data source feature accepts user-supplied post identifiers without validating ownership or post publication status, exposing potentially sensitive metadata to lower-privileged authenticated users. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation activity and no CISA KEV listing has been issued.
Technical ContextAI
The ECS WordPress plugin implements a dynamic repeater feature that fetches custom field values using a caller-supplied post ID parameter. WordPress post meta (custom fields) is a key-value store associated with each post, commonly used to hold configuration settings, API credentials, editor-facing data, or unpublished editorial content. The root cause maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the plugin reads and returns post meta for an arbitrary post ID without checking whether the requesting user has read permission for that post, or whether the post's status (private, draft, pending) restricts visibility. The CPE string cpe:2.3:a:unknown:ecs:*:*:*:*:*:*:*:* reflects an unresolved vendor identifier in NVD enrichment; WPScan is the authoritative reporting source. This class of flaw - broken object-level authorization on internal WordPress API calls - is common in plugins that build dynamic content blocks without re-validating WordPress capability and post-visibility rules.
RemediationAI
Update the ECS WordPress plugin to version 4.3.10 or later, which is the vendor-released patched version per the WPScan advisory at https://wpscan.com/vulnerability/0d4ccc34-632a-4058-9220-b3cce7a942dd/. Updates can be applied via the WordPress admin dashboard under Plugins > Installed Plugins > ECS > Update, or via WP-CLI with 'wp plugin update ecs'. If immediate patching is not possible, consider deactivating the ECS plugin entirely until the update is applied - this eliminates the vulnerability at the cost of losing all plugin functionality. As a secondary control, audit and restrict contributor-level account creation to reduce the pool of users who could exploit this flaw; however, this is a compensating measure and does not fix the underlying authorization gap. Additionally, audit custom field usage to identify whether sensitive values such as API keys or credentials are stored in post meta, as this determines the real-world data exposure scope.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today