Auth bypass in Metaphorcreations Ditty – Responsive News Tickers, Sliders, And Lists
CVE-2026-9011
The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the full item content of non-public Dittys — including drafts, pending, scheduled, and disabled entries — by enumerating integer post IDs against the ditty_init AJAX endpoint. Unlike the non-AJAX init() counterpart, init_ajax() does not verify that the requested Ditty has a 'publish' post status before loading and returning its items, allowing content that administrators explicitly withheld from public view to be extracted.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.006 (45.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 46th percentile — 45.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.006 · change: +0.001
Affected products
Weakness classification (CWE)
References
- www.wordfence.com/threat-intel/vulnerabilities/id/49fe8e8b-95fa-4c25-89cf-49566…
- plugins.trac.wordpress.org/browser/ditty-news-ticker/tags/3.1.65/includes/class…
- plugins.trac.wordpress.org/browser/ditty-news-ticker/tags/3.1.65/includes/class…
- plugins.trac.wordpress.org/browser/ditty-news-ticker/tags/3.1.65/includes/class…
- plugins.trac.wordpress.org/browser/ditty-news-ticker/tags/3.1.64/includes/class…
- plugins.trac.wordpress.org/browser/ditty-news-ticker/tags/3.1.64/includes/class…
- plugins.trac.wordpress.org/browser/ditty-news-ticker/tags/3.1.64/includes/class…
- plugins.trac.wordpress.org/changeset
Frequently asked questions
- What is CVE-2026-9011?
- CVE-2026-9011 is a high-severity vulnerability in Metaphorcreations Ditty – Responsive News Tickers, Sliders, And Lists, classified under Missing Authorization. CVSS score: 7.5/10. Published 2026-05-22.
- How severe is CVE-2026-9011?
- High severity. CVSS v3 base score is 7.5 out of 10.