Security Advisory

CVE-2026-19613

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-16 06:00:15

Last updated 2026-08-17 20:23:24

Assigner WPScan

CVSS score 6.5

State PUBLISHED

Description

The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post metadata from posts they do not own, including private and draft ones.

← Browse all CVEs View on cve.org ↗