CVE-2026-14229
ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 15, 2026
- Updated
- Aug 17, 2026
- Reserved
- Jun 30, 2026
Description
The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished (private, draft, pending) documents by supplying their identifier.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-284 Improper Access Control
Affected Products
| Product | Versions |
|---|---|
ECSUnknown |
|
References
- https://wpscan.com/vulnerability/52b44fc8-90af-45e4-a745-37e6369d8b6b/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.