# ECS <= 4.3.12 - Authenticated (Contributor+) Insecure Direct Object Reference to Dynamic Repeater Binding Modification

- **ID:** WPSEC-2026-1167
- **Plugin:** ECS – Ele Custom Skin for Elementor (`ele-custom-skin`), https://wordpress.org/plugins/ele-custom-skin/
- **Affected versions:** all versions before 4.3.13
- **Fixed in:** 4.3.13 (Update to 4.3.13 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ele-custom-skin
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1167/

## Description

The ECS – Ele Custom Skin for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference via the Dynamic Repeater Builder's ecs_drb_save_binding and ecs_drb_break_binding AJAX actions in all versions up to, and including, 4.3.12. This is due to missing validation on a user-controlled key: the handlers only check that the user can edit the supplied post ID and do not check that the element_id:control_key entry in the site-wide binding index belongs to that post. This makes it possible for authenticated attackers, with Contributor-level access and above, to overwrite or remove binding index entries that belong to other users' posts, which turns off the runtime data binding on those pages.

## References

- https://wpsec.com/vuln/WPSEC-2026-1167/
- https://plugins.svn.wordpress.org/ele-custom-skin/tags/4.3.13/
- https://wordpress.org/plugins/ele-custom-skin/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1167/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.