high8.6
CVE-2025-8085
The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to…
Impact
The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Metaphorcreations | Ditty | before 3.1.58 |