Ortto WordPress Plugin: Configuration overwrite via authentication bypass (CVE-2026-113387)

The Ortto plugin for WordPress is vulnerable to an authentication bypass (CVE-2026-113387) due to inadequate protection of configuration update requests. The plugin improperly relies on a secret that is publicly exposed in the HTML source code of the site. An unauthenticated attacker can leverage this exposed secret to authenticate unauthorized configuration update requests, allowing them to modify the plugin settings and inject arbitrary scripts into the site.

Impact

An attacker can overwrite the plugin configuration to serve arbitrary scripts, potentially resulting in Cross-Site Scripting (XSS), site defacement, or unauthorized client-side code execution for visitors to the WordPress site.

Recommendation

• Update the Ortto plugin for WordPress to version 1.0.25 or later immediately.
• Audit the site's public HTML source code for any references to plugin-specific secrets or configuration tokens.
• Monitor web server logs for unexpected POST requests to the Ortto plugin endpoints, specifically those originating from unauthenticated sessions or suspicious IP addresses.