The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2023-08-12T02:05:19.117Z
Updated: 2024-08-02T06:55:03.333Z
Reserved: 2023-06-28T19:14:28.550Z
Link: CVE-2023-3452
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-08-12T03:15:09.330
Modified: 2023-11-07T04:18:45.397
Link: CVE-2023-3452
Redhat
No data.