CVE-2026-114173

The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-201

Published

2026-10-29

Modified

2026-10-29

Record from

the NVD, synced 2026-10-29

References

• https://trust.canva.com?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8

Check your stackJSON