Authentication Bypass Vulnerability in Ortto Plugin for WordPress

CVE-2026-113387

What is CVE-2026-113387?

The Ortto plugin for WordPress, prior to version 1.0.25, is susceptible to an authentication bypass due to insecure handling of configuration update requests. This flaw allows unauthenticated individuals to exploit the plugin by overwriting its configuration settings. The vulnerability arises because the plugin relies solely on a publicly accessible secret embedded in HTML, enabling attackers to inject and execute arbitrary scripts. It is crucial for users of the Ortto plugin to upgrade to the latest version to mitigate this significant security risk.

References