# Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.71 - Missing Authorization to Unauthenticated Arbitrary Shortcode Execution via Editor Preview REST Routes

- **ID:** WPSEC-2026-2471
- **Plugin:** Ditty – Responsive News Tickers, Sliders, and Lists (`ditty-news-ticker`), https://wordpress.org/plugins/ditty-news-ticker/
- **Affected versions:** all versions before 3.1.72
- **Fixed in:** 3.1.72 (Update to 3.1.72 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ditty-news-ticker
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2471/

## Description

The Ditty plugin for WordPress is vulnerable to unauthorized access via the displayItems, phpItemMods and dynamicLayoutTags REST routes in all versions up to, and including, 3.1.71, due to the general_ditty_permissions_check permission callback returning true for every request. The handlers only verify a wp_rest nonce, and the plugin prints that nonce to logged-out visitors as well. The displayItems route renders item data taken from the request and passes item content through do_shortcode(). This makes it possible for unauthenticated attackers to render arbitrary Ditty preview content and execute arbitrary shortcodes.

## References

- https://wpsec.com/vuln/WPSEC-2026-2471/
- https://plugins.svn.wordpress.org/ditty-news-ticker/tags/3.1.72/
- https://wordpress.org/plugins/ditty-news-ticker/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2471/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.