Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

OttoKit plugin lets attackers gain higher privileges

CVE-2026-110372 · published today
Summary

The OttoKit plugin for WordPress (versions up to 1.1.40) can assign users more rights than intended. An attacker who can interact with the plugin could upgrade their account to an administrator level, potentially taking control of the site. Update the plugin to the latest version or remove it if it is not needed.

What to do
  • Update brainstorm force ottokit to version 1.1.41.
Affected software
VendorProductAffected versions
brainstorm force ottokit <= 1.1.40
Fix: upgrade to 1.1.41
Original advisory text
WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Type
CWE-266Incorrect Privilege Assignment
Timeline
Published18 Oct 2026
Updated18 Oct 2026
First seen18 Oct 2026
Sources
CVE-2026-110372 · NVD
CVE-2026-110372 · MITRE
Track software like this
Free during beta