EUVD-2026-57102
GHSA-fh54-f94w-q4hw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible unauthenticated endpoint with trivial access; C:H for full credential exposure; I:L added because persistent settings modification is explicitly described but absent from the provided vector.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently change some of its settings.
AnalysisAI
Unauthenticated database export exposure in the Ezoic WordPress plugin (versions 2.6.35 through before 2.23.1) allows any remote attacker to trigger a full server-side export of the site's database, harvesting user password hashes and active password reset tokens - the latter enabling immediate account takeover without password cracking. The same missing authorization flaw (CWE-862) additionally permits unauthenticated persistent modification of plugin settings. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against any WordPress installation running the Ezoic plugin in versions 2.6.35 through before 2.23.1 with default configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) correctly identifies trivial remote unauthenticated exploitation, but the integrity rating of I:N understates real-world impact: the description explicitly confirms that attackers can persistently alter plugin settings, implying at minimum I:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans for WordPress installations with the Ezoic plugin via HTTP fingerprinting or by checking plugin asset paths, then sends a crafted unauthenticated POST request to the vulnerable export endpoint. The server returns a database dump containing all user records including password hashes and any active reset tokens; the attacker uses a valid reset token to immediately authenticate as a WordPress administrator without cracking any passwords. … |
| Remediation | Upgrade the Ezoic WordPress plugin to version 2.23.1 or later immediately; this is the vendor-released patch confirmed via the WPScan advisory at https://wpscan.com/vulnerability/1e2ce237-dc91-4144-875a-339b5ea05f3a/ and NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-18789. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all WordPress instances running Ezoic versions 2.6.35 through 2.23.0 and disable the plugin immediately if upgrading cannot be completed urgently. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated broken authentication (CWE-288) in the Ezoic WordPress plugin versions 2.22.11 and earlier allows remote
Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress. Rated
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today