Critical severity · published Jun 14, 2024
CVE-2024-4936
Canto <= 3.0.8 - Unauthenticated Remote File Inclusion
9.8
CVSS
1%
EPSS
No
On KEV
Description
The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allow_url_include to be enabled on the target site in order to exploit.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Canto · flightbycanto
through 3.0.8 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-4936
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-4936
Patch
https://plugins.trac.wordpress.org/browser/canto/trunk/includes/lib/sizes.php#L15
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3105443%40canto&new=3104074%40canto&sfp_email=&sfph_mail=
Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/95a68ae0-36da-499b-a09d-4c91db8aa338?source=cve
More from Canto
5.3
CVE-2026-3335
Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload
4.3
CVE-2026-6441
Canto <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Setting Modification