Ortto Plugin for WordPress (< 1.0.25) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ortto-plugin-for-wordpress--1.0.25/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 09:12:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOrtto WordPress Plugin: Configuration overwrite via authentication bypass (CVE-2026-113387)https://feed.craftedsignal.io/briefs/2026-10-ortto-auth-bypass/Thu, 29 Oct 2026 09:12:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-ortto-auth-bypass/The Ortto plugin for WordPress versions prior to 1.0.25 contains an authentication bypass vulnerability that allows unauthenticated attackers to overwrite plugin configurations via exposed secrets, enabling the injection of arbitrary scripts.The Ortto plugin for WordPress is vulnerable to an authentication bypass (CVE-2026-113387) due to inadequate protection of configuration update requests. The plugin improperly relies on a secret that is publicly exposed in the HTML source code of the site. An unauthenticated attacker can leverage this exposed secret to authenticate unauthorized configuration update requests, allowing them to modify the plugin settings and inject arbitrary scripts into the site.

Impact

An attacker can overwrite the plugin configuration to serve arbitrary scripts, potentially resulting in Cross-Site Scripting (XSS), site defacement, or unauthorized client-side code execution for visitors to the WordPress site.

Recommendation

  • Update the Ortto plugin for WordPress to version 1.0.25 or later immediately.
  • Audit the site's public HTML source code for any references to plugin-specific secrets or configuration tokens.
  • Monitor web server logs for unexpected POST requests to the Ortto plugin endpoints, specifically those originating from unauthenticated sessions or suspicious IP addresses.
]]>highadvisorywordpressauthentication-bypassweb-applicationcve