CVE-2026-19613

The ECS WordPress plugin before 4.3.10 fails to enforce ownership or post-status checks for a dynamic repeater ACF data source that reads custom field values from a user-supplied post identifier. This allows users with contributor-level accounts or higher to read custom field values and post meta...