Description

The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post metadata from posts they do not own, including private and draft ones.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-16T06:16:52.023Z",
  "pubdate": "2026-08-16T06:16:52.023Z",
  "executiveSummary": "An insecure direct object reference and missing authorization vulnerability exists in the ECS WordPress plugin prior to version 4.3.10. The vulnerability stems from a lack of proper ownership and post-status validation when dynamic repeater data sources process user-supplied post identifiers to retrieve custom field values. This security flaw allows malicious actors authenticated as contributors or higher to read arbitrary custom field values and sensitive post metadata belonging to posts they neither own nor possess administrative viewing permissions for, including private and draft posts. The risk implications include unauthorized information disclosure of confidential draft content, sensitive metadata, and proprietary custom fields stored within the WordPress database. Exploitation requires authenticated access at the contributor privilege level or above to interact with the vulnerable dynamic repeater data source functionality.",
  "technicalDetails": "The vulnerability resides within the dynamic repeater data source component of the ECS WordPress plugin affecting versions prior to 4.3.10. The fundamental root cause is the absence of access control checks, specifically missing post ownership verification and post-status validation routines, prior to querying custom field values and post metadata from the underlying WordPress database.\nDuring standard operation, the vulnerable component processes user-supplied post identifiers to dynamically read custom fields. However, the lack of input validation and authorization enforcement means the application fails to verify whether the authenticated user possesses legitimate permissions to view the targeted post ID. Consequently, a low-privileged user, such as one holding a contributor-level account, can manipulate the input post identifier to reference arbitrary posts.\nThe step-by-step attack flow proceeds as follows: First, an authenticated attacker with contributor-level privileges or higher crafts an HTTP request targeting the vulnerable dynamic repeater data source endpoint within the ECS plugin. Second, the attacker injects a target post identifier corresponding to a restricted resource, such as a private post, draft, or another user's protected content, into the request parameter. Third, the vulnerable component processes the user-supplied post identifier without validating post ownership or checking the publication status of the requested post. Fourth, the application queries the database for the associated custom field values and post metadata of the specified target post. Finally, the server returns the retrieved sensitive custom field data and metadata within the application response, completing the unauthorized information disclosure cycle.\nThe post-exploitation impact includes the systematic harvesting of confidential metadata, internal notes, and sensitive custom field values associated with unpublished drafts, pending reviews, and private posts restricted to higher-privileged roles like editors or administrators. The attack requires network access to the target WordPress installation and an active, authenticated session with contributor-level privileges or higher."
}