Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.71 - Missing Authorization to Unauthenticated Arbitrary Shortcode Execution via Editor Preview REST Routes
- ID
- WPSEC-2026-2471
- Plugin
- Ditty – Responsive News Tickers, Sliders, and Lists (ditty-news-ticker)
- Affected
- all versions before 3.1.72
- Remediation
- Update to 3.1.72 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-04
- Attack surface
- Ditty – Responsive News Tickers, Sliders, and Lists on WPSec AttackSurface
- Fix released
- Published
Description
The Ditty plugin for WordPress is vulnerable to unauthorized access via the displayItems, phpItemMods and dynamicLayoutTags REST routes in all versions up to, and including, 3.1.71, due to the general_ditty_permissions_check permission callback returning true for every request. The handlers only verify a wp_rest nonce, and the plugin prints that nonce to logged-out visitors as well. The displayItems route renders item data taken from the request and passes item content through do_shortcode(). This makes it possible for unauthenticated attackers to render arbitrary Ditty preview content and execute arbitrary shortcodes.
References
- https://wpsec.com/vuln/WPSEC-2026-2471/
- https://plugins.svn.wordpress.org/ditty-news-ticker/tags/3.1.72/
- https://wordpress.org/plugins/ditty-news-ticker/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS