What is the CVSS score of CVE-2026-8681?

CVE-2026-8681 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Essential Chat Support CVE-2026-8681

EUVD-2026-30669 MEDIUM

Missing Authorization (CWE-862)

2026-05-16 Wordfence

GHSA-4fcc-vrwx-v754

Authentication Bypass WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 16, 2026 - 03:12 vuln.today

DescriptionCVE.org

The Essential Chat Support plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset all plugin configuration settings - including general settings, display rules, custom CSS, and WooCommerce tab settings - to their defaults by sending a POST request with ecs_reset_settings=1.

AnalysisAI

Authorization bypass in Essential Chat Support plugin for WordPress versions ≤1.0.1 allows unauthenticated remote attackers to reset all plugin configuration settings to defaults via a single POST request. The vulnerability stems from missing authorization checks in the settings reset function, enabling tampering with general settings, display rules, custom CSS, and WooCommerce integration without credentials. CVSS 5.3 indicates medium severity with network-accessible exploitation requiring no privileges or user interaction. No public exploit identified at time of analysis, though the attack is trivial given the simple POST parameter requirement.

Technical ContextAI

This vulnerability affects the Essential Chat Support WordPress plugin (CPE: cpe:2.3:a:essentialplugin:essential_chat_support) through version 1.0.1. The root cause is CWE-862 (Missing Authorization), where the plugin's settings registration function in register-settings.php and ecs-functions.php processes ecs_reset_settings POST requests without verifying current_user_can() capabilities or WordPress nonces. WordPress plugins should implement authorization checks using WordPress's capability system (e.g., manage_options for administrative functions) and validate nonces to prevent CSRF and unauthorized access. The vulnerability specifically affects the settings reset functionality at the ecs_reset_settings action handler, which directly processes user input at line 47 of register-settings.php and line 33 of ecs-functions.php without any authentication wrapper.

RemediationAI

WordPress site administrators should immediately update Essential Chat Support plugin to version 1.0.2 or later if available, or remove the plugin entirely if not actively used for business operations. Verify current version in WordPress admin dashboard under Plugins section and check WordPress plugin repository at https://wordpress.org/plugins/essential-chat-support/ for patched releases. As compensating controls until patching: implement web application firewall rules blocking POST requests containing ecs_reset_settings parameter from untrusted sources (noting this prevents legitimate administrative use of the reset feature); restrict WordPress admin area access to trusted IP addresses via .htaccess or server configuration; monitor WordPress logs for unexpected POST requests to wp-admin/admin.php or admin-ajax.php with ecs_reset_settings parameters. Alternative mitigation is disabling the plugin through WordPress admin or renaming the plugin directory via FTP/SSH, which completely eliminates exposure but removes chat support functionality. Review plugin settings after applying fixes to ensure configurations were not tampered with during vulnerable period.