CVE-2026-113387: High severity Ortto Ortto plugin for WordPress vulnerability
The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ortto plugin for WordPressto a version that resolves this vulnerability.Fixed in 1.0.25
Event History
Frequently Asked Questions
Which installations are affected?
Ortto plugin for WordPress versions before 1.0.25 are affected.
Does exploitation require an account or user interaction?
No. The vulnerability is network-accessible and can be exploited without privileges or user interaction.
What could an attacker do after exploiting this issue?
An attacker could overwrite the plugin configuration and cause the site to serve arbitrary scripts.
What should be done if patching cannot happen immediately?
The provided information does not specify a workaround. Prioritize updating the Ortto plugin to version 1.0.25 or later.