Junglewise Threat Intelligence

CVE-2026-9011: Ditty WordPress Plugin authorization bypass in ditty_init AJAX endpoint

CVE-2026-9011 · Severity: high · CVSS 7.5 · Published 2026-05-22

Technologies: Metaphor Creations Ditty. Vendors: Metaphor Creations.

Executive brief

The Ditty plugin for WordPress, which is used to create news tickers and sliders, contains a security flaw that allows unauthorized access to private content. An attacker can view drafts, scheduled posts, and other hidden entries that were never intended for public view. This could lead to the exposure of sensitive internal information or upcoming announcements before they are ready for release.

Technical details

The Ditty plugin for WordPress is vulnerable to a missing authorization check (CWE-862) in its AJAX handling logic. Specifically, the 'init_ajax()' function in versions up to and including 3.1.65 fails to verify the post status of a requested Ditty item. By sending requests to the 'ditty_init' AJAX endpoint and enumerating integer post IDs, an unauthenticated remote attacker can bypass intended access controls. This allows for the extraction of full item content from entries marked as draft, pending, scheduled, or disabled. The vulnerability is addressed in versions following 3.1.65.

Affected products

  • Ditty Ditty – Responsive News Tickers, Sliders, and Lists Up to and including 3.1.65

Timeline

  • 2026-05-22: disclosed
  • 2026-05-22: advisory

References

Related threats