OttoKit CVE-2026-110372

Requires a target running the OttoKit (SureTriggers) WordPress plugin at version 1.1.40 or earlier; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are stated as prerequisites, implying remote exploitation reachable over the network against affected installations. The principal limiting factor is simply having the vulnerable plugin installed and active at an affected version; defenders should note that the input does not specify whether a particular OttoKit feature, connected integration, or API must be enabled, and the 'privilege escalation' class leaves open whether a pre-existing low-privileged account is needed despite the PR:N rating - this should be verified against the Patchstack advisory.

This is a genuine high-priority issue, not merely a high-CVSS paper tiger. The vendor (Patchstack) assigns CVSS 9.8 with vector AV:N/AC:L/PR:N/UI:N, indicating a network-reachable, low-complexity privilege-escalation flaw (CWE-266, Incorrect Privilege Assignment) requiring no authentication or user interaction, with high confidentiality, integrity, and availability impact. The combination of PR:N and a privilege-escalation outcome means an unauthenticated attacker can obtain elevated (likely administrator-level) WordPress access, which effectively equals full site compromise. However, several real-risk signals are MISSING from the provided data: no EPSS exploitation-probability score, no CISA KEV listing, and no POC indicator are present, so the exploitation status is 'no public exploit identified at time of analysis.' There is also a latent tension worth verifying: the vulnerability class 'privilege escalation' often presupposes an existing (low-privileged) account, yet the CVSS vector states PR:N (unauthenticated) - this should be confirmed with Patchstack/vendor, as it determines whether this is a pre-auth account-takeover or a post-auth role elevation. Given the plugin's popularity and the critical, low-complexity, network-exploitable profile, this warrants prompt patching even absent confirmed active exploitation.

An attacker sends crafted requests to a WordPress site running OttoKit (SureTriggers) version 1.1.40 or earlier and abuses the incorrect privilege assignment to gain elevated privileges without valid credentials, per the CVSS AV:N/PR:N/UI:N vector. Because the CVSS complexity is low (AC:L), the attack is reliable and repeatable once the vulnerable endpoint is reached. No public exploit code is identified in the provided data, but the automation/connector nature of the plugin makes it an attractive mass-scanning target.