Authorization Bypass in Essential Chat Support for WordPress

CVE-2026-8681

What is CVE-2026-8681?

The Essential Chat Support plugin for WordPress is susceptible to an authorization bypass issue in all versions up to and including 1.0.1. This vulnerability arises because the plugin fails to adequately verify user authorization before allowing actions, enabling unauthenticated attackers to reset the plugin’s configuration settings. By sending a simple POST request with the parameter ecs_reset_settings=1, attackers can revert settings such as general configuration, display rules, custom CSS, and WooCommerce tab settings to their defaults, potentially compromising site integrity and user experience.

References