Ortto WordPress Plugin EUVD-2026-112569

The target must be a WordPress site with the Ortto plugin installed and active at a version before 1.0.25; no non-default configuration is required because the design itself exposes the gating secret in public HTML and the configuration-update request is never authenticated. In effect this is remote unauthenticated exploitation against default configurations of Ortto <1.0.25. The practical limiting factors are narrow: the site must actually run this specific plugin and version, and the attacker must retrieve the exposed secret from the page source (which is available by design). There is no user-interaction, authentication, or privilege prerequisite per the supplied CVSS vector.

The input CVSS of 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) describes an easily reached flaw: network vector, low complexity, no privileges, and no user interaction, which matches the description of an unauthenticated configuration-overwrite made trivial because the only gating secret is exposed in public HTML. That combination means exploitation is mechanically simple for any remote attacker who reads the page source. However, the supporting exploitation signals are modest: no EPSS probability was supplied, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit reference is present (the only reference is a Canva trust-center link, not a technical write-up). The vuln.today decision label is 'this_week', i.e. a prompt-but-not-emergency priority, consistent with 'high severity, low observed-exploitation evidence.' One signal tension to verify: the input marks Scope Unchanged (S:U) with Integrity High, yet the stated outcome - serving arbitrary scripts to site visitors - is a stored-script-injection effect that executes in visitors' browsers, which arguably crosses a scope boundary; the C:L/I:H split should be confirmed with the vendor. Net: a genuine, easy-to-exploit authentication-bypass worth patching in the near term, but without current evidence of active or automated exploitation it is not an emergency.

A remote, unauthenticated attacker views the public HTML of a WordPress site running the Ortto plugin, extracts the secret that the plugin exposes there, and replays it in a crafted configuration-update request. Because the update endpoint does not authenticate the caller, the attacker overwrites the plugin's configuration so that it serves attacker-controlled JavaScript to every visitor. No public exploit code was identified at the time of analysis, but the low-complexity network vector makes manual exploitation straightforward.