CVE-2026-114173: Medium severity Ortto Ortto plugin for WordPress vulnerability
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.
Affected Software
Event History
Frequently Asked Questions
Which stores are exposed?
Affected WordPress stores using the Ortto plugin before version 1.0.25 are exposed when WooCommerce product data is embedded in public storefront pages. The issue can disclose product passwords and private product metadata.
Does exploitation require an account or user interaction?
No. The vulnerability is exploitable remotely by an unauthenticated attacker and does not require user interaction.
What should be done if an affected version is deployed?
Update the Ortto WordPress plugin to version 1.0.25 or later. If updating cannot happen immediately, prevent affected public storefront pages from embedding the relevant WooCommerce product data.