Vulnerability in ECS WordPress Plugin Allows Unauthorized Configuration Changes
CVE-2026-18807
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-18807?
The ECS WordPress plugin prior to version 4.3.8 lacks adequate capability and ownership verification for its dynamic repeater actions. This inadequate validation enables users with contributor-level access and above to read, modify, and delete post configurations they do not own, Furthermore, it allows these users to alter the plugin's site-wide presets. Such vulnerabilities can lead to significant security risks, allowing unauthorized configuration changes that may compromise the integrity of the site's information and settings.
Affected Version(s)
ECS 0 < 4.3.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.