CVE-2026-18807: Unknown Ecs

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding configuration of posts they do not own and to change the ECS WordPress plugin before 4.3.8's site-wide presets.

Affected products

• Unknown Ecs: before 4.3.8 (fixed in 4.3.8)

Published 2026-08-15. Last modified 2026-08-26.