PT-2026-42740 · WordPress · Ditty

Published

2026-05-22

·

Updated

2026-05-22

·

CVE-2026-9011

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Ditty – Responsive News Tickers, Sliders, and Lists versions prior to 3.1.66
Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can retrieve the full content of non-public items, such as drafts, pending, scheduled, and disabled entries, by enumerating integer post IDs. This occurs via the 'ditty init' AJAX endpoint, where the init ajax() function fails to verify that the requested item has a 'publish' post status before returning the data, unlike the init() function.
Recommendations Update to a version later than 3.1.65.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-9011

Affected Products

Ditty