What is the CVSS score of CVE-2026-27355?

CVE-2026-27355 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

Ditty CVE-2026-27355

EUVD-2026-48152 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-mvpx-5vgf-mj2q

Authentication Bypass Ditty

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

6.5 MEDIUM

Network-accessible with no authentication required; I:L added independently because CWE-862 missing authorization typically enables some unauthorized write action, contrasting with the provided vector's I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:02 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.

AnalysisAI

Broken access control in the Ditty WordPress plugin (all versions through 3.1.66) permits unauthenticated remote attackers to invoke restricted plugin functionality without any credentials, yielding limited availability impact on affected WordPress sites. Reported by Patchstack and confirmed via NVD with CVSS 5.3 (Medium), the flaw stems from CWE-862 Missing Authorization - a failure to verify caller permissions before executing protected actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this accessible once the specific unprotected endpoint is known.

Technical ContextAI

CWE-862 (Missing Authorization) indicates the plugin executes a protected action without first verifying the requester holds the necessary WordPress capability. In WordPress plugin development this most commonly manifests as an AJAX handler (wp_ajax_nopriv_* hook) or a REST API endpoint registered without a permission_callback, allowing any visitor - authenticated or not - to trigger the action. The CPE string cpe:2.3:a:metaphorcreations:ditty:*:*:*:*:*:*:*:* confirms all releases of Ditty (formerly Ditty News Ticker) by Metaphor Creations up to and including 3.1.66 are within scope. The CVSS impact profile (C:N/I:N/A:L) suggests the unprotected endpoint triggers a disruptive but non-persistent action rather than a data read or write - consistent with operations such as resetting display state or clearing cached ticker content.

RemediationAI

Update the Ditty plugin to a version above 3.1.66 once a patched release is confirmed - monitor the WordPress plugin repository and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ditty-news-ticker/vulnerability/wordpress-ditty-plugin-3-1-66-broken-access-control-vulnerability) for the specific fixed version, as no exact patch version is independently confirmed in the available intelligence. As an interim measure, disabling the Ditty plugin on publicly reachable WordPress installations eliminates the attack surface entirely, at the cost of losing news ticker display functionality. If the plugin cannot be disabled, restricting access to WordPress admin and plugin endpoints via WAF or IP allowlist at the network perimeter reduces exposure, though this may affect legitimate front-end rendering that relies on the plugin's AJAX or REST calls. Patch deployment is preferred over workarounds given the low attack complexity.