CVE-2026-110372
CriticalCVSS 9.8Summary
The OttoKit plugin (up to version 1.1.40) has an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this to gain higher privileges.
Risk Assessment
This allows an attacker to escalate privileges and take control of the site or system. It can lead to full site compromise.
Recommendation
Update the OttoKit plugin to the latest version that fixes this vulnerability. Check for any unauthorized changes in user privileges.
Other vulnerabilities in OttoKit
See all- CVE-2026-49781Critical
There is an unauthenticated PHP Object Injection vulnerability in OttoKit versions <= 1.1.27.
- CVE-2026-32553High
OttoKit versions up to 1.1.35 contain an unauthenticated Server Side Request Forgery (SSRF) vulnerability. An attacker can send requests from the server to internal resources.
- CVE-2026-39479High
The OttoKit suretriggers plugin by Brainstorm Force up to version 1.1.20 inclusive is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in an SQL command.
Original NVD description (English source)
Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS