{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/ortto/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ortto:ortto:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-113387"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ortto plugin for WordPress (\u003c 1.0.25)"],"_cs_severities":["high"],"_cs_tags":["wordpress","authentication-bypass","web-application","cve"],"_cs_type":"advisory","_cs_vendors":["Ortto"],"content_html":"\u003cp\u003eThe Ortto plugin for WordPress is vulnerable to an authentication bypass (CVE-2026-113387) due to inadequate protection of configuration update requests. The plugin improperly relies on a secret that is publicly exposed in the HTML source code of the site. An unauthenticated attacker can leverage this exposed secret to authenticate unauthorized configuration update requests, allowing them to modify the plugin settings and inject arbitrary scripts into the site.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker can overwrite the plugin configuration to serve arbitrary scripts, potentially resulting in Cross-Site Scripting (XSS), site defacement, or unauthorized client-side code execution for visitors to the WordPress site.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Ortto plugin for WordPress to version 1.0.25 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit the site's public HTML source code for any references to plugin-specific secrets or configuration tokens.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for unexpected POST requests to the Ortto plugin endpoints, specifically those originating from unauthenticated sessions or suspicious IP addresses.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T09:12:34Z","date_published":"2026-10-29T09:12:34Z","id":"https://feed.craftedsignal.io/briefs/2026-10-ortto-auth-bypass/","summary":"The Ortto plugin for WordPress versions prior to 1.0.25 contains an authentication bypass vulnerability that allows unauthenticated attackers to overwrite plugin configurations via exposed secrets, enabling the injection of arbitrary scripts.","title":"Ortto WordPress Plugin: Configuration overwrite via authentication bypass (CVE-2026-113387)","url":"https://feed.craftedsignal.io/briefs/2026-10-ortto-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Ortto","version":"https://jsonfeed.org/version/1.1"}