The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress contains an authorization bypass flaw in versions 3.1.65 and earlier. The flaw lies in the ditty_init AJAX endpoint, which fails to verify that the requested Ditty has a 'publish' status before loading and returning its items. As a result, unauthenticated users can enumerate post IDs and retrieve the full content of drafts, pending, scheduled, and disabled entries that are otherwise hidden from public view. This leads to direct exposure of sensitive content that administrators intended to keep private.

The vulnerability affects all versions of the Ditty plugin up to and including 3.1.65. The plugin is distributed under the vendor name metaphorcreations, specifically the product Ditty – Responsive News Tickers, Sliders, and Lists. Any user running any of these affected releases faces risk.

The CVSS score is 7.5, indicating a high severity. The EPSS score is not available, but the lack of a listing in CISA’s KEV catalog implies no confirmed exploitation yet. Nonetheless, the flaw is easy to exploit by simply sending requests to the ditty_init AJAX action with incremental post IDs, requiring no authentication. An attacker with basic network access can retrieve private content, potentially compromising confidentiality. Immediate attention is warranted until a patched release is applied.