CloudMap 漏洞情报库

中危CVE-2026-33352026/07/28

Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload

The Canto plugin for WordPress is vulnerable to missing authorization in the copy-media.php upload flow. The file is directly accessible and accepts attacker-controlled parameters for the upload destination, allowing unauthenticated users to upload arbitrary files constrained to WordPress-allowed MIME types. The fbc_app_api parameter controls the domain WordPress fetches from via wp_safe_remote_get, enabling SSRF to attacker-controlled infrastructure.

cantoPoC 已收录

CVSS—

严重CVE-2023-34522026/02/26

WordPress Canto Plugin <= 3.0.4 - File Inclusion

Canto plugin for WordPress up to version 3.0.4 contains a remote file inclusion caused by the 'wp_abspath' parameter, letting unauthenticated attackers include and execute arbitrary remote code if allow_url_include is enabled, exploit requires allow_url_include to be enabled.

cantoPoC 已收录

CVSS—

中危CVE-2020-289762020/12/01

WordPress Canto 1.3.0 - Blind Server-Side Request Forgery

WordPress Canto plugin 1.3.0 is susceptible to blind server-side request forgery. An attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

cantoPoC 已收录

CVSS5.3EPSS 13.7%

canto

关联漏洞

Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload

WordPress Canto Plugin <= 3.0.4 - File Inclusion

WordPress Canto 1.3.0 - Blind Server-Side Request Forgery