CVE-2026-14229 is an improper access control vulnerability (CWE-284) in the ECS WordPress plugin prior to version 4.3.8. The flaw arises because the plugin fails to check the post status or user capabilities when rendering Elementor documents through certain AJAX actions. As a result, unauthenticated attackers can access the rendered content of unpublished posts, including private, draft, or pending documents, by supplying their identifiers in the request.

An attacker without authentication can retrieve the rendered content of unpublished Elementor documents, potentially exposing sensitive or private content that should not be publicly accessible. There is no impact on integrity or availability reported, only confidentiality is affected at a low level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict access to AJAX endpoints or implement custom access controls to prevent unauthorized retrieval of unpublished content.