Unauthorized Data Access in ECS WordPress Plugin by N3rdish
CVE-2026-19613
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-19613?
The ECS WordPress plugin prior to version 4.3.10 features a security flaw where it fails to enforce proper ownership and post-status checks when retrieving custom field values based on user-supplied post identifiers. This oversight permits users with contributor-level access or higher to access and read sensitive post metadata, including details from private and draft posts that they do not own. This vulnerability poses a significant risk to site confidentiality and data integrity.
Affected Version(s)
ECS 0 < 4.3.10
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.