ECS WordPress Plugin CVE-2026-19613

Exploitation requires a valid contributor-level (or higher) WordPress account on the target site - editors, authors, and administrators are also affected but typically already have broader access. The specific vulnerable component is the ECS plugin's dynamic repeater data source, which must be installed and active in a version below 4.3.10. No non-default server configuration or special network position is required beyond authenticated HTTP access to the WordPress installation. Exploitation is limited by the SSVC Automatable: no assessment, meaning mass unauthenticated scanning is not viable - an attacker must first acquire credentials. The absence of a CISA KEV listing and the low EPSS percentile further indicate this is not being exploited at scale. Risk is highest in multi-author WordPress sites where contributor access is granted to semi-trusted or external users, where those users could enumerate and read metadata from private or draft posts authored by others.

The CVSS 6.5 (Medium) vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is internally consistent: network-exploitable with low complexity but gated behind at least contributor-level authentication (PR:L), with high confidentiality impact and no integrity or availability effect. The SSVC assessment (Exploitation: poc, Automatable: no, Technical Impact: partial) corroborates this - a public proof-of-concept lowers the bar, but the non-automatable flag reflects the need for valid credentials rather than unauthenticated mass scanning. EPSS at 0.15% (5th percentile) signals that exploitation has not been widely observed, and no CISA KEV listing exists. The practical risk is highest in multi-author WordPress environments where contributor accounts are issued to less-trusted users; in single-author or tightly controlled deployments, the realistic threat is significantly reduced. The C:H rating is contingent on what post meta is actually stored - if custom fields contain API keys, credentials, or sensitive draft content, real-world impact escalates. No data conflicts across sources are present; all signals are consistent.

An attacker who has obtained or registered a contributor-level WordPress account on a target site running ECS plugin below 4.3.10 crafts HTTP requests to the plugin's dynamic repeater data source endpoint, supplying post IDs belonging to posts they do not own. By iterating numeric post IDs, the attacker retrieves custom field values and metadata from private drafts or other restricted posts, potentially exfiltrating unpublished editorial content, embedded API keys, or sensitive configuration data. The WPScan-published proof-of-concept lowers the technical barrier for this attack, requiring only authenticated WordPress access.