Unauthorized Access Vulnerability in ECS WordPress Plugin
CVE-2026-14229
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-14229?
The ECS WordPress plugin prior to version 4.3.8 has a critical vulnerability that permits unauthenticated users to access unpublished documents. This flaw occurs due to inadequate checks on post status or user capabilities when rendering Elementor documents through AJAX actions. As a result, attackers can retrieve sensitive content tagged as private, draft, or pending by simply supplying the document's identifier, which can lead to exposure of confidential information.
Affected Version(s)
ECS 0 < 4.3.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.