{"id":"CVE-2026-113387","revision":"61cb6da7a03e4dc78fb54fd92e091dfd","records":[{"revision":"61cb6da7a03e4dc78fb54fd92e091dfd","observedAt":"2026-10-29T03:48:01.066+00:00","statement":{"source":"cve-program","id":"CVE-2026-113387","aliases":[],"title":"The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary …","description":"The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.","state":0,"publishedAt":"2026-10-29T01:40:39.02+00:00","modifiedAt":"2026-10-29T02:02:12.845+00:00","affected":[{"ecosystem":"Vendor product","name":"ortto","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"canva\",\n                    \"product\": \"ortto\",\n                    \"platforms\": [\n                        \"WordPress\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"1.0.25\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","score":8.6,"severity":"HIGH"}],"references":["https://trust.canva.com/?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113387","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-113387","identifiers":["CVE-2026-113387"]},"retained":false,"historicalAffected":[]}],"coverage":[]}