CVE-2026-18789
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently change some of its settings.
Risk Assessment
An unauthenticated attacker can obtain sensitive authentication data and change configuration, potentially leading to full account takeover or site compromise.
Recommendation
Update the Ezoic plugin to version 2.23.1 or later. Immediately check for unauthorized data export and reset user passwords.
Original NVD description (English source)
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently change some of its settings.