CVE-2026-9011

Vulnerability

The Ditty plugin for WordPress includes an AJAX endpoint ditty_init implemented in init_ajax() in class-ditty-singles.php [1][2]. Unlike the non-AJAX init() function, init_ajax() does not verify that the requested Ditty post has a publish post status before returning its items [1][2]. This allows any post status—including draft, pending, future, or disabled—to be returned. The issue affects all versions up to and including 3.1.65 [3][4].

Exploitation

An unauthenticated attacker can send a POST request to the ditty_init AJAX action with a numeric id parameter. By enumerating integer post IDs, the attacker can retrieve the full item content of any Ditty, regardless of its intended visibility. No authentication or user interaction is required.

Impact

Successful exploitation leads to information disclosure of non-public Ditty entries, including drafts, pending, scheduled, and disabled content. The attacker gains access to the full item data without any privileges, potentially exposing sensitive information that administrators intended to keep hidden.

Mitigation

As of the publication date (2026-05-22), a patched version has not been explicitly announced in the provided references. Users should update to the latest version of the plugin as soon as a fix is available. Meanwhile, disabling the ditty_init AJAX endpoint via a WordPress plugin or custom code may serve as a temporary workaround.