EUVD-2026-66952
GHSA-9w3x-r85w-h3g8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Description specifies subscriber-level access is required, making PR:L more accurate than PR:N; no confidentiality or availability impact is indicated.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Subscriber Broken Access Control in Ditty <= 3.1.67 versions.
AnalysisAI
Broken access control in the Ditty WordPress plugin (versions up to and including 3.1.67) allows subscriber-level authenticated users to perform actions beyond their authorized scope, classified under CWE-862 (Missing Authorization). Reported by Patchstack with a CVSS 3.1 score of 5.3 Medium, the flaw is particularly impactful on WordPress sites with open user registration, where any self-registered subscriber could exploit it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires at minimum a WordPress subscriber-level authenticated account on the target site, which on sites with open user registration is obtainable by self-registration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) scores 5.3 Medium and suggests a fully unauthenticated network attack, but this conflicts with the description, which explicitly ties exploitation to 'Subscriber' accounts - indicating at minimum PR:L is more accurate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free subscriber account on a target WordPress site running Ditty 3.1.67 or earlier, then crafts HTTP requests to the plugin's unprotected endpoints - such as REST API or admin-ajax actions - to perform content modifications (create, edit, or delete Ditty items) that should require editor or administrator privileges. Because the authorization check is absent rather than bypassed, no advanced tooling is needed beyond a standard HTTP client. … |
| Remediation | The primary remediation is to update the Ditty plugin to a version beyond 3.1.67, which resolves the missing authorization checks. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoin
The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue (https://wpscan.com/vulnerabili
The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputti
The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (X
The Ditty WordPress plugin before 3.1.36 does not sanitise and escape some of its settings, which could allow high privi
The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privi
The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privi
The Ditty WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow hi
The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a ro
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Broken access control in the Ditty WordPress plugin (all versions through 3.1.66) permits unauthenticated remote attacke
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today