CVE-2026-8681
🔶 mediumSummary
The Essential Chat Support plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset all plugin configuration settings — including general settings, display rules, custom CSS, and WooCommerce tab settings — to their defaults by sending a POST request with ecs_reset_settings=1.
CVSS Score
5.3
Medium
EPSS Score
0.0
Exploit Probability
Published Date
2026-05-16
First Seen: 2026-05-17
📊 Relative Risk Intelligence
This CVE is Lower Risk - more severe than 19.8% of all 325,703 vulnerabilities in our database.
#261,296
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: May 18, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
YES
Can be exploited automatically
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
Abhirup Konwar
SSVC data provided by
CISA
Last Modified
2026-05-18
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE IDs (Weakness Types)