CVE-2026-81274— WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability
Quick assessment
Affected
metaphorcreations Ditty
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Ditty 3.1.67 及更早版本中的“Subscriber Broken Access Control”（订阅者访问控制缺陷）漏洞。
Possible ATT&CK Techniques 3 AI
T1078 · Valid Accounts T1190 · Exploit Public-Facing Application T1469
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81274
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Subscriber Broken Access Control in Ditty <= 3.1.67 versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| metaphorcreations | Ditty | n/a ~ 3.1.67 | - |
|
II. Public POCs for CVE-2026-81274
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81274
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-81274 (1)
IV. Related Vulnerabilities
Same product: Ditty
-
CVE-2026-27355
WordPress Ditty plugin <= 3.1.66 - Broken Access Control vul -
CVE-2025-60105
WordPress Ditty Plugin <= 3.1.58 - Cross Site Scripting (XSS -
CVE-2025-8085
Ditty < 3.1.58 - Unauthenticated SSRF -
CVE-2024-13357
Ditty – Responsive News Tickers, Sliders, and Lists < 3.1.52 -
CVE-2023-47764
WordPress Ditty plugin <= 3.1.24 - Broken Access Control vul
Same vendor: metaphorcreations
-
CVE-2026-4244
Post Duplicator <= 3.0.11 - Missing Authorization to Authent -
CVE-2026-4245
Post Duplicator <= 3.0.11 - Authorization Bypass to Authenti -
CVE-2026-27355
WordPress Ditty plugin <= 3.1.66 - Broken Access Control vul -
CVE-2026-39474
WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Inje -
CVE-2026-9011
Ditty <= 3.1.65 - Missing Authorization to Unauthenticated S
Same weakness: CWE-862
-
CVE-2026-81276
WordPress Kali Forms plugin <= 2.4.23 - Broken Access Contro -
CVE-2026-81272
WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access C -
CVE-2026-80433
WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensit -
CVE-2026-27330
WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Brok -
CVE-2026-81279
WordPress Push Notification for Post and BuddyPress plugin <
V. Comments for CVE-2026-81274
No comments yet