Patchstack published CVE-2026-110372 on Oct 16 (CVE record Oct 18): OttoKit by Brainstorm Force, versions 1.1.40 and earlier, lets an unauthenticated attacker escalate privileges up to admin through incorrect privilege assignment. It's rated CVSS 9.8, and Patchstack expects it to be used in mass-exploit campaigns. It was reported by Peter Tang on Oct 11 and fixed in 1.1.41. WordPress.org lists 90,000+ active installs, and the current version is 1.1.42. Patchstack hasn't published technical details, and no exploitation has been reported yet. Update now, then review admin accounts and application passwords created recently.