{"id":"CVE-2026-114173","title":"The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages","summary":"The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected s…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-201"],"vendor":"canva","product":"ortto","affected":["ortto < 1.0.25"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-29T01:49:36.815264Z"},"published":"2026-10-29","updated":"2026-10-29","sourceUpdated":"2026-10-29T02:02:12.706Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114173","references":[{"url":"https://trust.canva.com?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8"}],"tags":["cve.org"],"epss":0.00285,"epssPercentile":0.21098,"ingestedAt":"2026-10-31T01:14:13.029Z","slug":"CVE-2026-114173","body":"## Overview\n\nThe Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.\n\n## Affected\n\n- `ortto < 1.0.25`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}