# CVE-2026-110372: OttoKit - Privilege Escalation

> Live exploitation tracking for CVE-2026-110372 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-110372

## Key facts

- **Exploitation phase:** Insufficient Data. Not enough CrowdSec telemetry data is available to confidently assess how this vulnerability is exploited in the wild.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Brainstorm Force OttoKit
- **Weaknesses:** CWE-266 (Incorrect Privilege Assignment)
- **Tags:** wordpress, cms

## Description

Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.

## CrowdSec analysis

[CVE-2026-110372](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-110372) is a critical privilege escalation vulnerability in Brainstorm Force OttoKit, affecting versions through 1.1.40. Incorrect privilege assignment could allow unauthenticated remote attackers to gain elevated access and compromise the confidentiality, integrity, and availability of the affected system.

CrowdSec has been tracking this vulnerability and its exploits since 23rd of October 2026.

CrowdSec network observations suggest that most exploitation of CVE-2026-110372 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2026-110372. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Observed exploitation attempts target `/wp-json/sure-triggers/v1/automation/action` and send the `st-authorization: Bearer connection-denied` header to access the automation API without authentication. Attackers may use this access to create or modify WordPress accounts, including administrator accounts.

## Timeline

- 2026-10-18: CVE Published. CVE-2026-110372 is published to NVD.
- 2026-10-23: Rule Released. CrowdSec releases a rule to detect CVE-2026-110372 exploitation attempts against the CrowdSec Network.
- 2026-10-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-110372 for the first time.

## References

- https://patchstack.com/database/wordpress/plugin/suretriggers/vulnerability/wordpress-ottokit-plugin-1-1-40-privilege-escalation-vulnerability?_s_id=cve
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-110372.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-110372) follows observed exploitation activity for CVE-2026-110372. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.