CVE-2026-18789 — Ezoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-si…
Published: 2026-08-12 · CVSS: 7.5 · CVSS 3.1
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently change some of its settings.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7