{"id":"CVE-2026-110372","kind":"vulnerability","aliases":["CVE-2026-110372"],"related":[],"title":"Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege…","description":"Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.","summary":"OttoKit, a WordPress plugin from Brainstorm Force (suretriggers), assigns privileges incorrectly, letting a low-privileged user escalate their rights. An attacker who can log in gets higher-level access to the site.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ottokit","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"Check the installed OttoKit plugin version in the WordPress admin plugins page; versions through 1.1.40 are affected.","fix":"Update OttoKit to a version later than 1.1.40 (the sources do not name the fixed version).","status":"open","published_at":"2026-10-18T11:16:36+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-23T22:04:47+00:00","updated_at":"2026-10-23T22:28:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:04:47Z","model":"claude-haiku-5-5","output":{"fix":"Update OttoKit to a version later than 1.1.40 (the sources do not name the fixed version).\nunknown","reach":"internet","impact":"high","summary":"OttoKit, a WordPress plugin from Brainstorm Force (suretriggers), assigns privileges incorrectly, letting a low-privileged user escalate their rights. An attacker who can log in gets higher-level access to the site.","category":"package","who_cares":["wordpress","ottokit","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with a low-privilege account gains elevated site administrator rights.","analyst_note":"Confirm the fixed version and whether exploitation is public; the NVD entry lists only 'from n/a through 1.1.40' and the CVSS 9.8 score is unverified by other sources.","how_to_check":"Check the installed OttoKit plugin version in the WordPress admin plugins page; versions through 1.1.40 are affected.\nunknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000478,"input_tokens":2734,"output_tokens":409,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-110372':14A,17A '-2026':13A,16A '1.1.40':76C 'access':54B 'affect':71C 'allow':10A,67C 'assign':3A,32B,60C 'attack':45B 'brainstorm':6A,29B,63C 'cve':12A,15A 'escal':41B 'escalation.this':69C 'forc':7A,30B,64C 'get':50B 'higher':52B 'higher-level':51B 'host':22B 'incorrect':1A,34B,58C 'issu':70C 'let':35B 'level':53B 'log':48B 'low':38B 'low-privileg':37B 'n/a':74C 'ottokit':8A,18B,24B,65C,72C 'packag':19B 'plugin':27B 'privileg':2A,11A,33B,39B,59C,68C 'right':43B 'self':21B 'self-host':20B 'site':57B 'suretrigg':9A,31B,66C 'user':40B 'vulner':4A,61C 'wordpress':23B,26B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T11:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110372","severity":null,"published_at":"2026-10-18T11:16:36+00:00","modified_at":"2026-10-19T19:17:20+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}