What the vulnerability does
01Description
The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the full item content of non-public Dittys — including drafts, pending, scheduled, and disabled entries — by enumerating integer post IDs against the ditty_init AJAX endpoint. Unlike the non-AJAX init() counterpart, init_ajax() does not verify that the requested Ditty has a 'publish' post status before loading and returning its items, allowing content that administrators explicitly withheld from public view to be extracted.
Explanation of Vulnerability in Simple Terms
02Summary
Ditty – Responsive News Tickers, Sliders, and Lists versions 3.1.65 and earlier lack proper authorization checks, allowing unauthenticated attackers to read sensitive data. An attacker can access information without logging in or performing any user interaction. Site administrators should update to a version newer than 3.1.65 immediately.
What an attacker can do
03Attacker Capabilities
Read sensitive data from the site without authentication.
Potential impact on your site
04Site Impact
Confidential information may be exposed to anyone on the internet.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 22, 2026
CVE published
May 23, 2026
Record updated
