PT-2026-130565
CVE-2026-113387
·
Published
2026-10-29
·
Updated
2026-10-29
Description by
CVSS 3.1
8.6
HighMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.
Found an issue in the description? Have something to add? Feel free to write us 👾