Critical severity · published Aug 12, 2023
CVE-2023-3452
The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter
9.8
CVSS
7%
EPSS
No
On KEV
Description
The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.0% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Canto · Canto
through 3.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3452
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3452
Third Party Advisory
https://plugins.trac.wordpress.org/browser/canto/trunk/includes/lib/tree.php?rev=2841358#L5
Patch
https://plugins.trac.wordpress.org/changeset/2951888/canto/trunk/includes/lib/tree.php
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/a76077c6-700a-4d21-a930-b0d6455d959c?source=cve
More from Canto
9.8
CVE-2024-4936
Canto <= 3.0.8 - Unauthenticated Remote File Inclusion
9.8
CVE-2024-25096
Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc
9.8
CVE-2022-40305
A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network, overload network resources, and possibly have unspecified…
7.2
CVE-2020-24063
The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF
5.3
CVE-2020-28978
The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability