9.8Crítica

CVE-2026-110372WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability

Brainstorm Force OttoKit Publicada: 2026-10-18 14:00 (hace 16 días)

Descripción

Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.

Debilidad (CWE): CWE-266

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
Brainstorm Force	OttoKit	≤ 1.1.40

Referencias y parches

https://patchstack.com/database/wordpress/plugin/suretriggers/vulnerability/wordpress-ottokit-plugin-1-1-40-p… vdb-entry

Puntuación CVSS

9.8Crítica

Fuente: Patchstack · CVSS 3.1

Vector de ataque: Red
Complejidad: Baja
Privilegios: Ninguno
Interacción del usuario: Ninguna
Alcance: Sin cambio
Confidencialidad: Alto
Integridad: Alto
Disponibilidad: Alto

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Todas las puntuaciones (2)

cna	CVSS 3.1	9.8Crítica
audit@patchstack.com	CVSS 3.1	9.8Crítica

EPSS (probabilidad de explotación en 30 días)

1.36%

superior al 72 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: yes
Impacto técnico: total

Cronología

ID reservado2026-10-14
Publicada2026-10-18 14:00
Llegó a IP-DB2026-10-24 23:41
Última actualización2026-10-19 22:17

Asignada por (CNA): Patchstack
Estado en NVD: Deferred

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — WordPress plugins & themes

5.3Media

CVE-2026-91075 hace 4 horas

Eupago Gateway For Woocommerce 4.5.0 - 4.7.5 - Unauthenticated Payment Confirmation Bypass

Eupago Gateway For Woocommerce

The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark…

5.3Media

CVE-2026-103327 hace 4 horas

CryptoCloud - Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Webhook Secret

CryptoCloud

The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthe…

Sin puntuación

CVE-2026-103379 hace 7 horas

WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API Token

WATI Chat and Notification

The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order…

Sin puntuación

CVE-2026-104647 hace 7 horas

weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()

weMail

The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as autho…

Sin puntuación

CVE-2026-104648 hace 7 horas

weMail <= 2.1.6 - Editor+ API Key Disclosure

weMail

The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credentia…

Sin puntuación

CVE-2026-105967 hace 7 horas

Gallery for Social Photo <= 1.0.0.41 - Unauthenticated SSRF via next_url Parameter

Gallery for Social Photo

The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read th…