PT-2026-41420 · WordPress · Essential Chat Support

Abhirup Konwar · Published 2026-05-16 · Updated 2026-05-17 · CVE-2026-8681

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Essential Chat Support versions prior to 1.0.2

Description The Essential Chat Support plugin for WordPress contains an authorization bypass. The plugin fails to properly verify if a user is authorized to perform specific actions, allowing unauthenticated attackers to reset all plugin configuration settings to their defaults. This includes general settings, display rules, custom CSS, and WooCommerce tab settings. The issue is triggered by sending a POST request containing the parameter ecs reset settings=1.

Recommendations Update the plugin to a version later than 1.0.1.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-8681

Affected Products

Essential Chat Support

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-8681 · Security Note
• https://twitter.com/VulmonFeeds/status/2055513361450668390 · Twitter Post
• https://twitter.com/infoflowcloud/status/2055867627898126648 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6b98ea22-4c82-45c6-8e29-75cc9a9185be?source=cve · Note
• https://twitter.com/CVEnew/status/2055866609831493773 · Twitter Post
• https://t.me/CVEtracker/53993 · Telegram Post
• https://plugins.trac.wordpress.org/browser/essential-chat-support/trunk/includes/ecs-functions.php#L33 · Note
• https://plugins.trac.wordpress.org/browser/essential-chat-support/trunk/includes/admin/settings/register-settings.php#L47 · Note
• https://twitter.com/TheRabbitPy/status/2055545761488671029 · Twitter Post