---
id: "CVE-2026-114173"
kind: "vulnerability"
aliases: ["CVE-2026-114173"]
title: "Ortto WordPress plugin leaks private WooCommerce product data on storefront pages"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "ortto", "package", "woocommerce", "wordpress"]
not_affected_if: ["plugin-1.0.25-or-later", "plugin-not-installed"]
published_at: "2026-10-29T02:16:50+00:00"
first_seen_at: "2026-10-29T02:36:47+00:00"
updated_at: "2026-10-29T02:38:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114173", "first_seen_at": "2026-10-29T02:36:47+00:00"}]
---

# Ortto WordPress plugin leaks private WooCommerce product data on storefront pages

The Ortto plugin for WordPress before 1.0.25 embeds WooCommerce product data into public pages without filtering it. An unauthenticated visitor can read product passwords and private product metadata from the store.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Ortto plugin version in the WordPress admin under Plugins, or with `wp plugin get ortto --field=version`
- Confirm whether the store uses WooCommerce product passwords or private product metadata

## Fix

- Update the Ortto plugin for WordPress to `1.0.25` or later
- Rotate any product passwords or secrets that may have been exposed on public pages

## Timeline

- 2026-10-29T02:36:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114173

## From the sources

The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_