The ECS WordPress plugin before version 4.3.8 does not enforce ownership or capability checks on its dynamic repeater actions, relying only on a nonce that is accessible to any user who can open the page builder. This weakness allows a contributor or higher user to read, alter, or delete the binding configuration of posts that are not owned by them and to modify the site‑wide presets globally. As a result, attackers can tamper with the appearance or content of any post on the site, potentially defacing pages or injecting malicious content. The affected CWE is improper authorization (CWE‑285).

Vulnerable systems comprise any WordPress site running the ECS plugin version earlier than 4.3.8. The plugin is identified by the vendor/product pair Unknown:ECS. No further version granularity is available in the CNA data, but any installation prior to 4.3.8 is considered affected.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, yet the lack of authorization checks presents a moderate to high risk for sites that employ contributor accounts. The likely attack vector is the web‑based page builder interface; an attacker can trigger the vulnerability by simply visiting the page builder page, submitting a crafted request, or automating the process via a script. Successful exploitation grants the attacker the ability to change or delete post bindings and global presets, impacting the integrity and appearance of the site.