ECS <= 4.3.12 - Authenticated (Contributor+) Insecure Direct Object Reference to Dynamic Repeater Binding Modification
- ID
- WPSEC-2026-1167
- Plugin
- ECS – Ele Custom Skin for Elementor (ele-custom-skin)
- Affected
- all versions before 4.3.13
- Remediation
- Update to 4.3.13 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-17
- Attack surface
- ECS on WPSec AttackSurface
- Fix released
- Published
Description
The ECS – Ele Custom Skin for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference via the Dynamic Repeater Builder's ecs_drb_save_binding and ecs_drb_break_binding AJAX actions in all versions up to, and including, 4.3.12. This is due to missing validation on a user-controlled key: the handlers only check that the user can edit the supplied post ID and do not check that the element_id:control_key entry in the site-wide binding index belongs to that post. This makes it possible for authenticated attackers, with Contributor-level access and above, to overwrite or remove binding index entries that belong to other users' posts, which turns off the runtime data binding on those pages.
References
- https://wpsec.com/vuln/WPSEC-2026-1167/
- https://plugins.svn.wordpress.org/ele-custom-skin/tags/4.3.13/
- https://wordpress.org/plugins/ele-custom-skin/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS