Authorization Bypass in Ditty Plugin for WordPress

CVE-2026-9011

What is CVE-2026-9011?

The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress contains a vulnerability that allows unauthorized access to non-public content. Attackers can exploit this flaw by sending requests to the ditty_init AJAX endpoint without authentication, potentially exposing sensitive data such as drafts and disabled entries. The plugin fails to validate user authorization, thus permitting the retrieval of items marked as not publicly accessible, posing a risk to content security.

References