Ditty WordPress Plugin CVE-2026-9011

Target site must have the Ditty - Responsive News Tickers, Sliders, and Lists plugin installed and activated at version 3.1.65 or earlier, with admin-ajax.php reachable from the attacker's network position (the default WordPress configuration). Exploitation requires no authentication, no user interaction, and works against default plugin configurations - the unauthenticated ditty_init AJAX action is registered for any visitor. The limiting factor on real-world value is the content side: the bug only discloses Ditty entries, so sites that only use the plugin for already-public tickers expose nothing sensitive, while sites that author drafts, scheduled posts, or disabled Dittys with confidential text are meaningfully impacted. Integer post-ID enumeration is required to find non-public entries, but WordPress post IDs are sequential and trivially scanned.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflects a network-reachable, low-complexity, unauthenticated confidentiality-only impact, scoring 7.5 (High). EPSS is not provided in the input, and the CVE is not on the CISA KEV list, so there is no confirmed active exploitation. No public PoC has been linked, though exploitation is trivial - a simple POST to admin-ajax.php with action=ditty_init and an enumerated post ID - and the WordPress plugin ecosystem historically sees rapid weaponization of disclosed authorization-bypass bugs, especially those reported by Wordfence. Real-world impact is bounded to confidentiality of Ditty entries (drafts, scheduled, disabled), so sites using Ditty merely for public tickers may see little material exposure, while sites staging sensitive embargoed content in Dittys face meaningful leakage risk. Treat as a priority patch for sites that author non-public Dittys; lower urgency where only published tickers exist.

An unauthenticated attacker scripts repeated POST requests to the target site's /wp-admin/admin-ajax.php with action=ditty_init and an incrementing ditty_id parameter, harvesting the rendered item content of every Ditty post ID regardless of post_status. This yields embargoed announcements, internal-only news tickers, scheduled marketing copy, or any other content an administrator deliberately marked as draft, pending, scheduled, or disabled, enabling competitive intelligence gathering or pre-disclosure leaks. No public exploit identified at time of analysis, but the request shape is straightforward to reproduce from the patch diff and trac source references.