CVE-2026-14229

MediumCVSS 5.3/10Last modified Aug 26, 2026

Description

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished (private, draft, pending) documents by supplying their identifier.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Aug 15, 2026
Last modified
Aug 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-14239.8A vulnerability was determined in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the fCVE-2026-142305.4The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated oCVE-2026-142314.3The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifyingCVE-2026-142347.1The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticatedCVE-2026-142357.5The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it prompCVE-2026-142364.7The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and CVE-2026-142377.2The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their pCVE-2026-142384.1The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in CVE-2026-142397.1The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameteCVE-2026-14247.2A vulnerability was identified in PHPGurukul News Portal 1.0. This affects an unknown part of the component Profile Pic Handler. The manipulCVE-2026-142405.3The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible dirCVE-2026-142419.8Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effor
CVE-2026-14229: Medium severity, CVSS 5.3 | Vulnix