CVE-2026-18789

Deferred Deferred - Pending Action

Unauthenticated Database Export in Ezoic WordPress Plugin

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently change some of its settings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-18789

EUVD

EUVD-2026-57102

Affected Vendors & Products

Vendor	Product	Version / Range
ezoic	ezoic_wordpress_plugin	to 2.23.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-18789 affects the Ezoic WordPress plugin before version 2.23.1. It involves improper access restrictions in the plugin's content export functionality, allowing unauthenticated attackers to trigger a server-side database export. This includes sensitive data like user password hashes and password reset tokens. Attackers can also persistently alter plugin settings.

Detection Guidance

Check if the Ezoic WordPress plugin version is below 2.23.1 by inspecting the plugin files or WordPress admin panel. Look for unauthorized database exports or unusual plugin setting changes in server logs.

Impact Analysis

Unauthenticated attackers could steal sensitive user data such as password hashes and reset tokens, potentially leading to account takeovers. They may also modify plugin settings, altering site behavior or security configurations. This could result in data breaches, unauthorized access, or site defacement.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR due to unauthorized access and exposure of personal data. For HIPAA, if the site handles protected health information, the breach could violate confidentiality requirements. Organizations may face fines or legal penalties for failing to protect sensitive data.

Mitigation Strategies

Update the Ezoic WordPress plugin to version 2.23.1 or later immediately. Review server logs for signs of exploitation and reset all user passwords and password reset tokens as a precaution.

Hi! I’m here to help you understand CVE-2026-18789. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70