Published: 12/08/2023 Updated: 07/11/2023

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 0

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated malicious users to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.

Vulnerable Product	Search on Vulmon	Subscribe to Product
canto canto

WordPress Canto versions prior to 305 suffer from remote file inclusion and shell upload vulnerabilities ...

Wordpress Plugin Canto < 3.0.5 - Remote File Inclusion (RFI) and Remote Code Execution (RCE)

CVE-2023-3452-PoC - Wordpress Plugin Canto < 305 - Remote File Inclusion (RFI) - Remote Code Execution (RCE) - Unauthenticated Here we explain a PoC of the latest RFI (Remote File Inclusion) vulnerability of the Canto Wordpress Pluging, and we have developed an exploit to automate the execution of commands "The Canto plugin for WordPress is vulnerable to Remote F

An exploitation tool for the Remote File Inclusion (RFI) and Remote Code Execution (RCE) vulnerability in the WordPress plugin Canto, enabling attackers to execute arbitrary code on the target server.

Canto Remote File Inclusion (RFI) and Remote Code Execution (RCE) Exploit This tool exploits the Remote File Inclusion (RFI) and Remote Code Execution (RCE) vulnerability in the WordPress plugin Canto, allowing attackers to execute arbitrary code on the target server Description The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and includ

https://www.wordfence.com/threat-intel/vulnerabilities/id/a76077c6-700a-4d21-a930-b0d6455d959c?source=cve https://plugins.trac.wordpress.org/changeset/2951888/canto/trunk/includes/lib/tree.php https://plugins.trac.wordpress.org/browser/canto/trunk/includes/lib/tree.php?rev=2841358#L5 https://nvd.nist.gov https://github.com/leoanggal1/CVE-2023-3452-PoC https://packetstormsecurity.com/files/177300/WordPress-Canto-Remote-Shell-Upload.html

CVE-2023-3452

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect