Access Control Flaw in Ezoic WordPress Plugin
CVE-2026-18789
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-18789?
An access control vulnerability exists in the Ezoic WordPress plugin prior to version 2.23.1, which fails to adequately restrict access to its content export features. This flaw enables unauthorized users to exploit the plugin, resulting in the ability to trigger an unwanted server-side export of the website's database. Such an export could expose sensitive information, including user password hashes and password reset tokens, and could also allow attackers to persistently modify various site settings without authentication.
Affected Version(s)
Ezoic 2.6.35 < 2.23.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.