{"id":"CVE-2026-113387","kind":"vulnerability","aliases":["CVE-2026-113387"],"related":[],"title":"WordPress Ortto plugin: unauthenticated config overwrite serves attacker scripts","description":"The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.","summary":"The Ortto plugin for WordPress before 1.0.25 accepts configuration update requests guarded only by a secret printed in public HTML. An unauthenticated attacker can overwrite the plugin's configuration so that it serves arbitrary scripts to visitors.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ortto","package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","updated-to-1.0.25"],"how_to_check":"- Check the installed Ortto plugin version in the WordPress admin Plugins page or with `wp plugin get ortto --field=version`\n- Confirm whether the Ortto plugin is active on the site","fix":"- Update the Ortto plugin to `1.0.25` or later\n- Review the plugin's stored configuration for unexpected script URLs or injected code after updating","status":"open","published_at":"2026-10-29T02:16:49+00:00","first_seen_at":"2026-10-29T02:36:47+00:00","triaged_at":"2026-10-29T02:38:01+00:00","updated_at":"2026-10-29T02:38:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T02:38:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Ortto plugin to `1.0.25` or later\n- Review the plugin's stored configuration for unexpected script URLs or injected code after updating","reach":"internet","title":"WordPress Ortto plugin: unauthenticated config overwrite serves attacker scripts","impact":"high","summary":"The Ortto plugin for WordPress before 1.0.25 accepts configuration update requests guarded only by a secret printed in public HTML. An unauthenticated attacker can overwrite the plugin's configuration so that it serves arbitrary scripts to visitors.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","ortto","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker serves arbitrary scripts to site visitors via plugin configuration","analyst_note":"Confirm the affected version range and the fixed release against the NVD entry and the plugin's changelog or WordPress.org advisory.","how_to_check":"- Check the installed Ortto plugin version in the WordPress admin Plugins page or with `wp plugin get ortto --field=version`\n- Confirm whether the Ortto plugin is active on the site","needs_analyst":true,"not_affected_if":["plugin-not-installed","updated-to-1.0.25"],"who_is_affected":"Sites running the Ortto plugin for WordPress at a version before `1.0.25` are exposed, because the configuration update endpoint trusts a secret that any visitor can read in the page HTML. Sites without the Ortto plugin, or already on `1.0.25` or later, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00063,"input_tokens":3305,"output_tokens":598,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113387':12A,15A '-2026':11A,14A '1.0.25':31B,68C 'accept':32B 'actor':87C 'arbitrari':58B,96C 'attack':8A,47B 'authent':71C 'config':5A 'configur':33B,53B,72C,93C 'could':88C 'cve':10A,13A 'expos':80C 'guard':36B 'host':20B 'html':44B,83C 'ortto':2A,16B,26B,63C 'overwrit':6A,49B,89C 'packag':17B 'plugin':3A,24B,27B,51B,64C,91C 'print':41B 'public':43B,82C 'reli':75C 'request':35B,74C 'script':9A,59B,97C 'secret':40B,79C 'self':19B 'self-host':18B 'serv':7A,57B,95C 'threat':86C 'unauthent':4A,46B,85C 'updat':34B,73C 'visitor':61B 'wordpress':1A,21B,23B,29B,66C 'wordpress-plugin':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Ortto plugin for WordPress at a version before `1.0.25` are exposed, because the configuration update endpoint trusts a secret that any visitor can read in the page HTML. Sites without the Ortto plugin, or already on `1.0.25` or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T02:16:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","cvss_by":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113387","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113387","severity":null,"published_at":"2026-10-29T02:16:49+00:00","modified_at":"2026-10-29T02:16:49+00:00","first_seen_at":"2026-10-29T02:36:47+00:00","fetched_at":"2026-10-29T02:36:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}