CVE-2026-113387

{
  "etk_id": "ETK-2026-2930",
  "cve_id": "CVE-2026-113387",
  "display_id": "CVE-2026-113387",
  "ghsa_id": "GHSA-jqqj-mjjm-8jrv",
  "euvd_id": "EUVD-2026-112569",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated configuration update in Ortto WordPress plugin",
  "summary": "Ortto for WordPress versions before 1.0.25 are affected. An unauthenticated attacker can change plugin configuration and cause arbitrary scripts to be served when the plugin's exposed secret can be obtained from public HTML.",
  "mitigation": "Upgrade the Ortto WordPress plugin to version 1.0.25 or later. Restrict exposure to affected sites until the update is installed.",
  "vendor": "canva",
  "product": "ortto",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.0.25"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.0.25"
      ],
      "package_name": "ortto",
      "purl": null
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 8.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 23.74036355,
  "t0_at": "2026-10-29T01:40:39.020000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-29T01:40:39.020000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T01:40:39.020000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-113387"
    }
  }
}