Live › vulnerability › CVE-2026-114173
Go to dashboardThe Ortto plugin for WordPress before 1.0.25 embeds WooCommerce product data into public pages without filtering it. An unauthenticated visitor can read product passwords and private product metadata from the store.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 02:36 UTC. All times on this page are UTC.
Sites that run the Ortto plugin below alongside WooCommerce and publish storefront pages. The exposure is in public storefront output, so stores without the plugin or without WooCommerce products carrying passwords or private metadata have less to lose.
1.0.25No product ranges from the sources yet.
wp plugin get ortto --field=version1.0.25 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.
This page as .md · .json · in your agent: get_signal("CVE-2026-114173")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.