{"id":"CVE-2026-114173","kind":"vulnerability","aliases":["CVE-2026-114173"],"related":[],"title":"Ortto WordPress plugin leaks private WooCommerce product data on storefront pages","description":"The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.","summary":"The Ortto plugin for WordPress before 1.0.25 embeds WooCommerce product data into public pages without filtering it. An unauthenticated visitor can read product passwords and private product metadata from the store.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","ortto","package","woocommerce","wordpress"],"not_affected_if":["plugin-1.0.25-or-later","plugin-not-installed"],"how_to_check":"- Check the installed Ortto plugin version in the WordPress admin under Plugins, or with `wp plugin get ortto --field=version`\n- Confirm whether the store uses WooCommerce product passwords or private product metadata","fix":"- Update the Ortto plugin for WordPress to `1.0.25` or later\n- Rotate any product passwords or secrets that may have been exposed on public pages","status":"open","published_at":"2026-10-29T02:16:50+00:00","first_seen_at":"2026-10-29T02:36:47+00:00","triaged_at":"2026-10-29T02:38:04+00:00","updated_at":"2026-10-29T02:38:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T02:38:04Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Ortto plugin for WordPress to `1.0.25` or later\n- Rotate any product passwords or secrets that may have been exposed on public pages","reach":"internet","title":"Ortto WordPress plugin leaks private WooCommerce product data on storefront pages","impact":"medium","summary":"The Ortto plugin for WordPress before 1.0.25 embeds WooCommerce product data into public pages without filtering it. An unauthenticated visitor can read product passwords and private product metadata from the store.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","ortto","ecommerce"],"confidence":0.7,"needs_auth":"no","worst_case":"unauthenticated visitors read product passwords and private product metadata","analyst_note":"","how_to_check":"- Check the installed Ortto plugin version in the WordPress admin under Plugins, or with `wp plugin get ortto --field=version`\n- Confirm whether the store uses WooCommerce product passwords or private product metadata","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-1.0.25-or-later"],"who_is_affected":"Sites that run the Ortto plugin below `1.0.25` alongside WooCommerce and publish storefront pages. The exposure is in public storefront output, so stores without the plugin or without WooCommerce products carrying passwords or private metadata have less to lose.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000595,"input_tokens":3296,"output_tokens":531,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114173':14A,17A '-2026':13A,16A '1.0.25':29B,60C 'actor':77C 'affect':88C 'could':78C 'cve':12A,15A 'data':8A,33B,67C 'ecommerc':18B 'emb':30B 'embed':69C 'filter':38B,63C 'leak':4A 'metadata':50B,85C 'ortto':1A,19B,24B,55C 'packag':20B 'page':11A,36B,73C 'password':46B,81C 'plugin':3A,25B,56C 'privat':5A,48B,83C 'product':7A,32B,45B,49B,66C,80C,84C 'public':35B,71C 'read':44B,79C 'store':53B,89C 'storefront':10A,72C 'threat':76C 'unauthent':41B,75C 'visitor':42B 'without':37B 'woocommerc':6A,21B,31B,65C 'wordpress':2A,22B,27B,58C","nicknames":[],"mitigations":[],"who_affected":"Sites that run the Ortto plugin below `1.0.25` alongside WooCommerce and publish storefront pages. The exposure is in public storefront output, so stores without the plugin or without WooCommerce products carrying passwords or private metadata have less to lose.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T02:16:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114173","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114173","severity":null,"published_at":"2026-10-29T02:16:50+00:00","modified_at":"2026-10-29T02:16:50+00:00","first_seen_at":"2026-10-29T02:36:47+00:00","fetched_at":"2026-10-29T02:36:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}