{"id":"CVE-2026-114173","aliases":[],"cve":{"records":[{"id":"CVE-2026-114173","source":"Canva","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-20T22:22:11.463Z","published":"2026-10-29T01:42:02.291Z","modified":"2026-10-29T02:02:12.706Z"}],"publishers":[{"name":"Canva","role":"CNA","organizationId":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6","modified":"2026-10-29T01:42:02.291Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T02:02:12.706Z"}],"references":[{"url":"https://trust.canva.com?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8","tags":[],"source":"Canva"}],"weaknesses":[{"id":"CWE-201","description":"CWE-201 Insertion of Sensitive Information Into Sent Data","source":"Canva"}],"applicability":[{"source":"Canva","statements":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:canva:ortto:*:*:*:*:*:wordpress:*:*","versionStartIncluding":"0","versionEndExcluding":"1.0.25"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T01:49:36.815264Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages.","titleSource":"Canva","descriptionSource":"Canva","description":"The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.","score":5.3,"severity":"medium","published":"2026-10-29T01:42:02.291Z","modified":"2026-10-29T02:02:12.706Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"canva","name":"ortto","platforms":["WordPress"],"versions":[{"version":"0","status":"affected","lessThan":"1.0.25","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"Canva","url":"https://www.cve.org/CVERecord?id=CVE-2026-114173"}],"remediation":[],"references":["https://trust.canva.com?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8"],"sources":[{"name":"CVE","id":"CVE-2026-114173","modified":"2026-10-29T02:02:12.706Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-114173"}],"assessments":[{"source":"Canva","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3}],"sourceAffected":[],"observedAt":"2026-10-29T14:33:41.141Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T04:55:31.932Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T08:50:36.080Z","attemptedAt":"2026-10-29T08:50:36.080Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T08:50:36.383Z","attemptedAt":"2026-10-29T08:50:36.383Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T08:50:36.698Z","attemptedAt":"2026-10-29T08:50:36.698Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T08:50:35.586Z","attemptedAt":"2026-10-29T08:50:35.586Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-114173","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114173","modified":"2026-10-29T04:18:23.997","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-10-29T08:50:36.080Z"},{"source":"GitHub Advisory Database","id":"GHSA-px8c-84hm-p82v","url":"https://github.com/advisories/GHSA-px8c-84hm-p82v","modified":"2026-10-29T03:30:29Z","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-10-29T08:50:36.383Z"},{"source":"ENISA EUVD","id":"EUVD-2026-112570","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112570","modified":"Oct 29, 2026, 2:02:12 AM","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-10-29T08:50:36.698Z"}],"aiSummary":{"text":"The Ortto plugin for WordPress before 1.0.25 embeds unfiltered WooCommerce product data in public pages, allowing unauthenticated access to product passwords and metadata. The weakness is due to the insertion of sensitive information into sent data.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:38:54.652Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-114173"}]}}