The Ortto plugin for WordPress versions before 1.0.25 does not properly authenticate configuration update requests. It relies solely on a secret exposed in public HTML, allowing unauthenticated attackers to overwrite the plugin's configuration and serve arbitrary scripts.