CVE-2026-113387 - Vulnerability Details - OpenCVE

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Canva	Ortto

No data.

No data.

References

Link	Providers
https://trust.canva.com?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8

History

Thu, 29 Oct 2026 02:45:00 +0000

Type	Values Removed	Values Added
Title		Authentication Bypass in Ortto WordPress Plugin Enables Arbitrary Script Overwrite

Thu, 29 Oct 2026 02:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 29 Oct 2026 01:45:00 +0000

Type	Values Removed	Values Added
Description		The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.
First Time appeared		Canva Canva ortto
Weaknesses		CWE-306
CPEs		cpe:2.3:a:canva:ortto::::::wordpress::*
Vendors & Products		Canva Canva ortto
References		https://trust.canva.com?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8
Metrics		cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L'}`

MITRE

Status: PUBLISHED

Assigner: Canva

Published: 2026-10-29T01:40:39.020Z

Updated: 2026-10-29T02:02:12.845Z

Reserved: 2026-10-20T04:54:48.863Z

Link: CVE-2026-113387

Vulnrichment

Updated: 2026-10-29T01:53:35.588Z

NVD

Status : Received

Published: 2026-10-29T02:16:49.937

Modified: 2026-10-29T04:18:23.603

Link: CVE-2026-113387

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-113387", "assignerOrgId": "61adb53e-e4b3-47f7-8a93-4717c9e77dc6", "state": "PUBLISHED", "assignerShortName": "Canva", "dateReserved": "2026-10-20T04:54:48.863Z", "datePublished": "2026-10-29T01:40:39.020Z", "dateUpdated": "2026-10-29T02:02:12.845Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "61adb53e-e4b3-47f7-8a93-4717c9e77dc6", "shortName": "Canva", "dateUpdated": "2026-10-29T01:40:39.020Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "type": "CWE"}]}], "affected": [{"vendor": "canva", "product": "ortto", "platforms": ["WordPress"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.25", "versionType": "semver"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:canva:ortto:*:*:*:*:*:wordpress:*:*", "versionStartIncluding": "0", "versionEndExcluding": "1.0.25"}]}]}], "descriptions": [{"lang": "en", "value": "The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts."}]}], "references": [{"url": "https://trust.canva.com?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "LOW", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"}}], "credits": [{"lang": "en", "value": "Sh3kaf", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-113387", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T01:49:46.256831Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T02:02:12.845Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-113387", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T01:49:46.256831Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T01:53:35.588Z"}}], "cna": {"source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Sh3kaf"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "canva", "product": "ortto", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.25", "versionType": "semver"}], "platforms": ["WordPress"], "defaultStatus": "unaffected"}], "references": [{"url": "https://trust.canva.com?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.", "supportingMedia": [{"type": "text/html", "value": "The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:canva:ortto:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "versionEndExcluding": "1.0.25", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "61adb53e-e4b3-47f7-8a93-4717c9e77dc6", "shortName": "Canva", "dateUpdated": "2026-10-29T01:40:39.020Z"}}}, "cveMetadata": {"cveId": "CVE-2026-113387", "state": "PUBLISHED", "dateUpdated": "2026-10-29T02:02:12.845Z", "dateReserved": "2026-10-20T04:54:48.863Z", "assignerOrgId": "61adb53e-e4b3-47f7-8a93-4717c9e77dc6", "datePublished": "2026-10-29T01:40:39.020Z", "assignerShortName": "Canva"}, "dataVersion": "5.2"}