CVE-2026-14229CWE-284broken-access-control

CVE-2026-14229

Medium · published August 15, 2026

CVSS v3.1

5.3

EPSS

Percentile

24.1

In the wild

Unconfirmed

What it is

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished (private, draft, pending) documents by supplying their identifier.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00323 · 24.1th percentile
Weakness: CWE-284 · Improper Access Control
Published: 2026-08-15T10:16Z

References (1)

https://wpscan.com/vulnerability/52b44fc8-90af-45e4-a745-37e6369d8b6b/ · [email protected]

EPSS history

Timeline

15 AUG 06:00Z
ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload
cvelistv5