What is GHSA-phww-7g4v-vrwj?

GHSA-phww-7g4v-vrwj is a security advisory published by GitHub Security Advisories with Medium severity. The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when...

Which CVE IDs does GHSA-phww-7g4v-vrwj cover?

GHSA-phww-7g4v-vrwj covers the following CVE IDs: CVE-2026-14229. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-phww-7g4v-vrwj?

GHSA-phww-7g4v-vrwj has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-phww-7g4v-vrwjMediumCVSS 5.3

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when...

Vendor

GitHub Security Advisories

Published

August 15, 2026

Last Modified

August 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-14229 →

📋 Description

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished (private, draft, pending) documents by supplying their identifier.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-14229
https://wpscan.com/vulnerability/52b44fc8-90af-45e4-a745-37e6369d8b6b
https://github.com/advisories/GHSA-phww-7g4v-vrwj