CVE-2026-114173

21th percentile - higher than 21% of all known CVEs

The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.

An unauthenticated attacker can obtain product passwords and private metadata, breaching store data confidentiality and potentially enabling unauthorized access to content.

Update the Ortto plugin to version 1.0.25 or later and verify that sensitive product data is not embedded in public pages.