Live › vulnerability › CVE-2026-113387
Go to dashboardThe Ortto plugin for WordPress before 1.0.25 accepts configuration update requests guarded only by a secret printed in public HTML. An unauthenticated attacker can overwrite the plugin's configuration so that it serves arbitrary scripts to visitors.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 02:36 UTC. All times on this page are UTC.
Sites running the Ortto plugin for WordPress at a version before are exposed, because the configuration update endpoint trusts a secret that any visitor can read in the page HTML. Sites without the Ortto plugin, or already on or later, are not affected.
1.0.251.0.25No product ranges from the sources yet.
wp plugin get ortto --field=version1.0.25 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.
This page as .md · .json · in your agent: get_signal("CVE-2026-113387")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.