CERT24GHSA-jqqj-mjjm-8jrv: Unauthenticated configuration changes in the Ortto WordPress pluginLoading data…
CERT24Threat Observatory
Period

GHSA-jqqj-mjjm-8jrv: Unauthenticated configuration changes in the Ortto WordPress plugin

The Ortto plugin for WordPress before version 1.0.25 did not authenticate configuration update requests and relied only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin’s configuration to serve arbitrary scripts.

← Back to intelligence

GHSA-jqqj-mjjm-8jrv: Unauthenticated configuration changes in the Ortto WordPress plugin

The Ortto plugin for WordPress before version 1.0.25 did not authenticate configuration update requests and relied only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin’s configuration to serve arbitrary scripts.