CVE-2026-19613

None

Open

TLP:CLEAR

ECS < 4.3.10 - Contributor+ Arbitrary Post Meta Disclosure via Dynamic Repeater ACF Source

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post metadata from posts they do not own, including private and draft ones.

Details

Confidence: 90%
Published: Aug 16, 2026
Last Modified: Aug 16, 2026

Notes

0

Log in to add a note

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

0

Log in to add an opinion

No opinions yet. Be the first to assess this intelligence.