EUVD-2026-112570
GHSA-px8c-84hm-p82v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRequest public storefront page
-
ExploitParse unfiltered embedded WooCommerce product data
-
ImpactHarvest product passwords and private metadata
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
|
| Exploitation Conditions | Exploitation requires a WordPress store running the Ortto plugin before 1.0.25 together with WooCommerce, where products carry passwords (WooCommerce password-protected products) or private product metadata that the plugin embeds into public storefront pages. The flaw is reachable remotely with no authentication and no user interaction (PR:N/UI:N), so default installations serving such product pages are exposed. The main limiting factors are environmental rather than access-based: the store must actually use the Ortto plugin and must contain product passwords or private metadata for anything sensitive to leak - stores without such protected/private product data have nothing to disclose, and only confidentiality is affected (no modification or disruption). |
| Impact | This is a moderate, confidentiality-only information disclosure (CVSS 5.3) rather than a high-urgency issue. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N) indicates a remote, low-complexity, unauthenticated read-only flaw with limited confidentiality impact and no integrity or availability impact, consistent with CWE-201 (exposure of sensitive information in generated output). All signals point the same direction and are internally consistent: there is no CISA KEV listing, no EPSS score was supplied, and no verified public exploit was provided - the sole reference is a Canva trust-center page, not a technical advisory or PoC. The vendor priority label is 'this_month', which aligns with a real-but-non-emergency fix cadence rather than act_now/emergency. The practical risk is bounded by what actually leaks: WooCommerce product passwords and private product metadata on stores that embed this data via the Ortto plugin. No conflicting signals were found between CVSS and the description; the main gap is the absence of EPSS and exploitation telemetry, so real-world exploitation frequency cannot be quantified from the provided data. |
| Exploit ScenarioDerived | An unauthenticated attacker browses or scrapes the public storefront pages of a WordPress/WooCommerce store running a vulnerable Ortto plugin (before 1.0.25) and reads WooCommerce product passwords and private product metadata that the plugin embedded into the page output without filtering. No authentication, user interaction, or special timing is required. No verified public exploit code was provided - the only reference is a Canva trust-center page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
Information disclosure in the Ortto plugin for WordPress before 1.0.25 exposes WooCommerce product passwords and private product metadata to anyone who loads an affected public storefront page, with no authentication or user interaction required (CVSS 5.3, confidentiality-only, CWE-201). The impact is bounded by the store's own content: only sites running Ortto alongside WooCommerce that actually hold password-protected products or private product metadata have sensitive data to leak, and integrity and availability are unaffected. No public exploit has been identified at time of analysis, and a vendor fix ships in version 1.0.25.
RemediationAI
Vendor-released patch: update the Ortto plugin to version 1.0.25 or later, which adds the missing filtering on WooCommerce product data embedded in public storefront pages. The update can be applied through the WordPress plugin administration screen or with WP-CLI, and the installed version should be verified afterward against the advisory at https://trust.canva.com?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8. Priority is this_month rather than emergency: the flaw is confidentiality-only and no public exploit has been identified, but the leak is unauthenticated and requires no user interaction, so any storefront that kept running pre-1.0.25 while exposing password-protected products has a plausible exposure window. Because the disclosed data includes product passwords and private metadata, treat it as a credential-compromise event: rotate any WooCommerce product passwords that were live during the exposure and review products whose private metadata was published. No vendor-documented workaround short of the 1.0.25 update is provided in the available sources.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the Ortto marketing/analytics plugin for WordPress, packaged under the Canva vendor namespace (cpe:2.3:a:canva:ortto) and tracked in the EUVD catalog as EUVD-2026-112570. Ortto enriches public storefront pages with WooCommerce product data, and that embedding path did not filter the fields it wrote into the rendered HTML. The root cause class is CWE-201 (Insertion of Sensitive Information Into Sent Data): rather than an access-control bypass or a SQL/command injection flaw, the plugin generates a response that contains data the requesting party should never have received - specifically WooCommerce password-protected product credentials and private product metadata. CWE-201 is a distinct child of CWE-200 and is notable because the leak is a byproduct of normal page generation, so no crafted request, payload, or elevated session is needed; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms the issue is reachable over the network by unauthenticated visitors with default configuration, with only confidentiality impacted (C:L/I:N/A:N). The trigger mechanics beyond the unfiltered embedding - for example which exact template or data attribute carries the leaked values - are not described in the available sources.
Know when Ortto gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Remote unauthenticated read of embedded product data with no user interaction gives AV:N/AC:L/PR:N/UI:N; limited confidentiality disclosure only, so C:L and I:N/A:N.
Primary rating from Vendor (Canva).
CVSS VectorVendor: Canva
Lifecycle Timeline
2DescriptionCVE.org
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated configuration overwrite in the Ortto plugin for WordPress (versions before 1.0.25) lets a remote attacke
Stored cross-site scripting in the Ortto plugin for WordPress before 1.0.25 lets an attacker with the ability to change
Exploit-DB