{"id":"CVE-2026-113387","title":"The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML","summary":"The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitra…","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","cvssSource":"cna","cwe":["CWE-306"],"vendor":"canva","product":"ortto","affected":["ortto < 1.0.25"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-29T01:49:46.256831Z"},"published":"2026-10-29","updated":"2026-10-29","sourceUpdated":"2026-10-29T02:02:12.845Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113387","references":[{"url":"https://trust.canva.com?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8"}],"tags":["cve.org"],"epss":0.00287,"epssPercentile":0.21281,"ingestedAt":"2026-10-31T01:14:13.028Z","slug":"CVE-2026-113387","body":"## Overview\n\nThe Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.\n\n## Affected\n\n- `ortto < 1.0.25`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}