CVE-2026-113387
CVE-2026-113387
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.
CVSS 8.6 · High · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
ortto
- Versions
- ≥ 0, < 1.0.25: Affected (semver)
Update to 1.0.25