EUVD-2026-48152
GHSA-mvpx-5vgf-mj2q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with Ditty plugin active
-
DeliverySend unauthenticated HTTP request to unprotected endpoint
-
ExploitBypass missing authorization check
-
ExecutionInvoke restricted plugin action
-
ImpactCause limited availability disruption to Ditty functionality
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required and no special configuration is needed - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation is possible from the network against any publicly reachable WordPress site with Ditty active and running version 3.1.66 or earlier. The plugin must be installed and active on the target; sites that have disabled or never installed Ditty are not exposed. Impact is bounded by the A:L rating - the unauthorized action causes limited, likely non-persistent availability disruption rather than data exfiltration or persistent modification, which limits the blast radius for any individual exploitation attempt. The key limiting factors are: (1) the plugin must be present and active, and (2) the concrete unprotected endpoint must be identified, which is not confirmed public knowledge at time of analysis. |
| Impact | The NVD-assigned CVSS 5.3 (Medium) vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L frames this as a trivially exploitable network flaw constrained to low availability impact with no confidentiality or integrity consequence. The 'Authentication Bypass' tag raises a flag: CWE-862 missing authorization typically implies some unauthorized modification capability (integrity), yet the provided vector shows I:N - this discrepancy should be verified against the full Patchstack advisory, as the true impact scope may be broader than the current CVSS captures. No EPSS score is present in the available intelligence; no KEV listing and no POC indicate real-world exploitation has not been observed or publicly demonstrated. Prioritization for most organizations is moderate - the plugin must be actively installed and internet-facing for exposure to exist, and the impact ceiling is limited even if exploited. |
| Exploit ScenarioDerived | An unauthenticated attacker discovers a WordPress site running Ditty 3.1.66 or earlier via passive scanning or CMS fingerprinting, then sends a crafted HTTP request directly to the plugin's unprotected AJAX handler or REST endpoint - requiring no session cookie or API key. The missing authorization check allows the request to proceed, invoking a restricted action that disrupts the plugin's operational availability on that site. No public POC has been identified, but the straightforward attack path (AV:N/AC:L/PR:N/UI:N) means exploitation requires only knowledge of the specific vulnerable endpoint. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Broken access control in the Ditty WordPress plugin (all versions through 3.1.66) permits unauthenticated remote attackers to invoke restricted plugin functionality without any credentials, yielding limited availability impact on affected WordPress sites. Reported by Patchstack and confirmed via NVD with CVSS 5.3 (Medium), the flaw stems from CWE-862 Missing Authorization - a failure to verify caller permissions before executing protected actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this accessible once the specific unprotected endpoint is known.
RemediationAI
Update the Ditty plugin to a version above 3.1.66 once a patched release is confirmed - monitor the WordPress plugin repository and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ditty-news-ticker/vulnerability/wordpress-ditty-plugin-3-1-66-broken-access-control-vulnerability) for the specific fixed version, as no exact patch version is independently confirmed in the available intelligence. As an interim measure, disabling the Ditty plugin on publicly reachable WordPress installations eliminates the attack surface entirely, at the cost of losing news ticker display functionality. If the plugin cannot be disabled, restricting access to WordPress admin and plugin endpoints via WAF or IP allowlist at the network perimeter reduces exposure, though this may affect legitimate front-end rendering that relies on the plugin's AJAX or REST calls. Patch deployment is preferred over workarounds given the low attack complexity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-862 (Missing Authorization) indicates the plugin executes a protected action without first verifying the requester holds the necessary WordPress capability. In WordPress plugin development this most commonly manifests as an AJAX handler (wp_ajax_nopriv_* hook) or a REST API endpoint registered without a permission_callback, allowing any visitor - authenticated or not - to trigger the action. The CPE string cpe:2.3:a:metaphorcreations:ditty:*:*:*:*:*:*:*:* confirms all releases of Ditty (formerly Ditty News Ticker) by Metaphor Creations up to and including 3.1.66 are within scope. The CVSS impact profile (C:N/I:N/A:L) suggests the unprotected endpoint triggers a disruptive but non-persistent action rather than a data read or write - consistent with operations such as resetting display state or clearing cached ticker content.
Know when Ditty gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-accessible with no authentication required; I:L added independently because CWE-862 missing authorization typically enables some unauthorized write action, contrasting with the provided vector's I:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoin
The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue (https://wpscan.com/vulnerabili
The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputti
The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (X
The Ditty WordPress plugin before 3.1.36 does not sanitise and escape some of its settings, which could allow high privi
The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privi
The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privi
The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow hi
Stored cross-site scripting in the Ditty WordPress plugin (versions through 3.1.69) allows an authenticated attacker hol
The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a ro
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Broken access control in the Ditty WordPress plugin (versions up to and including 3.1.67) allows subscriber-level authen
Exploit-DB