Is CVE-2026-113387 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-113387?

CVE-2026-113387 has a CVSS v3 severity of HIGH (8.6).

Back

CVE-2026-113387

Description

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.