CVE-2026-19613: ECS < 4.3.10 - Contributor+ Arbitrary Post Meta Disclosure via Dynamic Repeater ACF Source
The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post metadata from posts they do not own, including private and draft ones.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19613?
The severity of CVE-2026-19613 is rated at 45, indicating a moderate risk.
How do I fix CVE-2026-19613?
To fix CVE-2026-19613, you should update the ECS plugin to version 4.3.10 or later.
What kind of information can be disclosed through CVE-2026-19613?
CVE-2026-19613 allows arbitrary disclosure of custom field values and post metadata to users with contributor-level accounts or above.
Who is affected by CVE-2026-19613?
CVE-2026-19613 affects users of the ECS WordPress plugin version prior to 4.3.10.
What actions can contributors take due to CVE-2026-19613?
Contributors with access to the ECS plugin can exploit CVE-2026-19613 to read sensitive post metadata without proper permission checks.