8.6HIGH

CVE-2025-8085 — The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its…

Metaphorcreations · Ditty · Published 8 Sept 2025 · Modified 30 Sept 2026

Description

The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.

References

https://wpscan.com/vulnerability/f42c37bb-1ae0-49ab-bd81-7864dff0fcff/

What to do

Check whether Ditty is in your asset inventory.
Patch in the next maintenance window; prioritise internet-facing systems.
Record the decision in your risk register for audit evidence.

Alert me on similar CVEs →

Link: adminadda.com/cve/CVE-2025-8085