[ CVE-2026-114173 · Published 29 Oct 2026 ]
Vulnerability in canva ortto
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.