CVE-2026-27355

WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.

We have discovered 14,660 live websites that are affected by CVE-2026-27355.

Run a Free Instant Scan



Affected Software

Product  Ditty News Ticker
Category Wordpress Plugins
Vulnerable Domains14,660 live websites (100% of Ditty News Ticker install base)
Vulnerable Versions
  • from 0 through 3.1.66
Vulnerable Versions Count133 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-862 Missing Authorization



Details

  • Published - Jul 23, 2026
  • Updated - Jul 23, 2026

Credits

  • Legion Hunter | Patchstack Bug Bounty Program (finder)

Website Distribution by Country

Number of websites using CVE-2026-27355
United States4,019 websites


Germany3,917 websites
GB1,139 websites
India537 websites
Sweden359 websites
France340 websites
Italy339 websites
Netherlands299 websites
Russia291 websites
Canada230 websites

Website Distribution by TLD

Number of websites using CVE-2026-27355
.com4,600 websites
.de3,114 websites
.org1,310 websites
.co.uk586 websites
.net325 websites
.se287 websites
.nl271 websites
.ru250 websites
.it247 websites
.ch184 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-27355

Top websites that are affected by CVE-2026-27355. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*****.gov United States**,***
*************.com United States**,***
*******.de Germany**,***
*********.net Argentina**,***
***************.com United States**,***
********.**.il Israel**,***
***.org GB**,***
*************.com Germany**,***
************.com United States**,***
*********.de Germany**,***
See full domain list

FAQ

CVE-2026-27355 is Missing Authorization in Ditty News Ticker
A total of 14,660 websites have been identified as vulnerable to CVE-2026-27355, based on global website indexing conducted by WebTechSurvey.
The Ditty News Ticker is affected by the CVE-2026-27355 vulnerability.
Ditty News Ticker versions up to and including 3.1.66 are vulnerable to CVE-2026-27355.