All packages
Ditty vulnerabilities
3 known CVE vulnerabilities in Ditty, translated and rated.
- CVE-2026-27355Medium
The Ditty plugin for WordPress versions 3.1.66 and earlier contains a broken access control vulnerability exploitable by an unauthenticated attacker.
- CVE-2026-81274Medium
The Ditty plugin version 3.1.67 and earlier has a Subscriber Broken Access Control vulnerability. A user with the subscriber role can gain unauthorized access to functions they should not have permissions for.
- CVE-2026-9011High
Vulnerability in the Ditty plugin for WordPress up to version 3.1.65 – missing authorization check in the ditty_init AJAX endpoint allows unauthenticated attackers to retrieve content of non-public Dittys (including drafts, pending, scheduled, and disabled entries) by enumerating post IDs.