Ditty EUVD-2026-66952

Exploitation requires at minimum a WordPress subscriber-level authenticated account on the target site, which on sites with open user registration is obtainable by self-registration. The affected plugin (Ditty version 3.1.67 or earlier) must be installed and active. No special plugin configuration or non-default feature enablement is required beyond the plugin being present. Exploitation is limited to sites where either open registration is enabled or the attacker has obtained any low-privilege WordPress account through other means. Sites that disable user registration and have no untrusted authenticated users face negligible practical risk. The CVSS PR:N assignment appears to overstate the attack surface; PR:L (subscriber account required) better reflects the described conditions.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) scores 5.3 Medium and suggests a fully unauthenticated network attack, but this conflicts with the description, which explicitly ties exploitation to 'Subscriber' accounts - indicating at minimum PR:L is more accurate. This metric discrepancy should be verified against the vendor advisory before using the score in automated risk prioritization. EPSS data is absent from the provided intelligence, and the vulnerability is not listed in CISA KEV, meaning no confirmed active exploitation is known. The integrity-only impact (I:L, C:N, A:N) limits the blast radius; however, on sites with open registration the effective attack complexity drops to near-zero since obtaining a subscriber account requires only self-registration. No public exploit or POC code has been identified at time of analysis, which further moderates urgency. Overall this is a genuine but contained risk: prioritize patching on multi-tenant or publicly-registered WordPress deployments, and treat it as routine maintenance elsewhere.

An attacker registers a free subscriber account on a target WordPress site running Ditty 3.1.67 or earlier, then crafts HTTP requests to the plugin's unprotected endpoints - such as REST API or admin-ajax actions - to perform content modifications (create, edit, or delete Ditty items) that should require editor or administrator privileges. Because the authorization check is absent rather than bypassed, no advanced tooling is needed beyond a standard HTTP client. Sites with open registration require no prior relationship with the target.