Description
The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.
Published: 2026-10-29
Score: 8.6 High
EPSS: n/a
KEV: No
Impact: Unauthenticated configuration overwrite enabling arbitrary script execution
Action: Apply Patch
AI Analysis

Impact

The Ortto WordPress plugin versions before 1.0.25 lack proper authentication for configuration update requests. The plugin only relies on a secret that is exposed in public HTML, allowing an attacker who can access the site’s web interface to overwrite the plugin’s configuration and make the site serve arbitrary scripts. This flaw permits unrestricted modification of the plugin’s behavior and can lead to remote code execution or site compromise by delivering malicious content to visitors.

Affected Systems

This vulnerability affects the Ortto plugin distributed by Canva, specifically WordPress installations running Ortto versions earlier than 1.0.25.

Risk and Exploitability

The flaw has a CVSS score of 8.6, indicating high severity. No EPSS score is available and the vulnerability is not listed in CISA KEV, but the lack of authentication combined with a publicly exposed secret makes exploitation straightforward via web-based requests. An unauthenticated threat actor can trigger the attack on any publicly accessible WordPress site that has an vulnerable Ortto installation.

Generated by OpenCVE AI on October 29, 2026 at 02:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Ortto plugin to version 1.0.25 or later, which implements proper authentication for configuration changes.
  • If an upgrade is not immediately possible, temporarily deactivate the Ortto plugin to prevent further configuration modifications.
  • Ensure that any configuration interfaces for WordPress plugins are protected by role‑based access controls and remove any secrets that are publicly exposed in web pages.

Generated by OpenCVE AI on October 29, 2026 at 02:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 02:45:00 +0000

Type Values Removed Values Added
Title Authentication Bypass in Ortto WordPress Plugin Enables Arbitrary Script Overwrite

Thu, 29 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 29 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Description The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.
First Time appeared Canva
Canva ortto
Weaknesses CWE-306
CPEs cpe:2.3:a:canva:ortto:*:*:*:*:*:wordpress:*:*
Vendors & Products Canva
Canva ortto
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L'}

Subscriptions

Canva Ortto
cve-icon MITRE

Status: PUBLISHED

Assigner: Canva

Published:

Updated: 2026-10-29T02:02:12.845Z

Reserved: 2026-10-20T04:54:48.863Z

Link: CVE-2026-113387

cve-icon Vulnrichment

Updated: 2026-10-29T01:53:35.588Z

cve-icon NVD

Status : Received

Published: 2026-10-29T02:16:49.937

Modified: 2026-10-29T02:16:49.937

Link: CVE-2026-113387

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T02:30:07Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function