→ برگشت به فید آسیب‌پذیری‌ها CVE-2026-14229 · ele-custom-skin

نقص در بررسی سطح دسترسی (Missing Authorization) در افزونه ECS – Ele Custom Skin for Elementor

The ECS plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 4.3.7. This is due to missing visibility checks on the theme_id and post_id parameters in the wp_ajax_nopriv_ecsload handler before loading and returning Elementor document data. This makes it possible for unauthenticated attackers to access the content of private or password-protected Elementor documents by sending a crafted request to the ecsload AJAX endpoint.