CVE-2026-18789 is a missing authorization vulnerability (CWE-862) in the Ezoic WordPress plugin prior to version 2.23.1. The flaw allows unauthenticated attackers to access content export functionality without proper access controls, enabling them to trigger a server-side export of the site's database. This export includes sensitive information such as user password hashes and password reset tokens. Additionally, attackers can make persistent changes to some plugin settings. The vulnerability affects version 2.6.35 as explicitly stated. There is no CVSS score or vendor advisory indicating a patch or mitigation status at this time.

An unauthenticated attacker can obtain sensitive user data including password hashes and password reset tokens by exploiting the missing authorization in the plugin's export functionality. This exposure could lead to further compromise of user accounts if the data is cracked or reused. The ability to persistently change plugin settings may also allow attackers to maintain access or disrupt site functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's export functionality by limiting access to trusted users only, if possible, and monitor for suspicious activity related to the plugin. Avoid exposing the plugin to untrusted networks or users.