CVE-2026-113387
Received Received - Intake

Unauthenticated Configuration Update in Ortto WordPress Plugin

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: Canva

Description
The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-113387
EUVD
EUVD-2026-112569

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
canva ortto 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Ortto plugin for WordPress before version 1.0.25 had a security flaw where configuration updates were not authenticated. The plugin relied on a secret exposed in public HTML, allowing unauthenticated attackers to overwrite its configuration and inject arbitrary scripts.

Detection Guidance

Check if the Ortto WordPress plugin version is below 1.0.25 by inspecting the plugin files or WordPress admin panel. Look for unauthorized configuration changes in the plugin settings or public HTML output that exposes the secret key.

Impact Analysis

An attacker could exploit this to serve malicious scripts on your WordPress site, potentially stealing user data, spreading malware, or defacing your website. This could harm visitors and damage your site's reputation.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for protecting user data. Organizations may face fines, legal action, and reputational damage if exploited.

Mitigation Strategies

Update the Ortto plugin to version 1.0.25 or later immediately. Remove any exposed secret keys from public HTML and review plugin configurations for unauthorized changes. Monitor for suspicious scripts or activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113387. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart