CVE-2025-8085

The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.

Score

CVSS 3.1 8.6 High

Status

Analyzed - contact@wpscan.com

Published

2025-09-08

Last modified

2025-09-08

Weaknesses

CWE-918

Affected products

• Ditty (Metaphorcreations)
• Ditty (Unknown)

References

• https://wpscan.com/vulnerability/f42c37bb-1ae0-49ab-bd81-7864dff0fcff/