The Canto plugin allows unauthenticated users to trigger a file copy routine by POSTing to the /copy‑media.php endpoint without any authentication, nonce, or domain validation. The endpoint accepts the destination domain and API token as user‑supplied parameters and then downloads a file from the attacker‑controlled URL, storing it in the WordPress uploads directory. Because the fetched file originates entirely from the attacker’s infrastructure, a malicious actor can upload arbitrary content—including potentially executable PHP—subject only to WordPress' MIME type restrictions. This capability exposes the site to code execution, data tampering, or entry for further attacks via uploaded files.

WordPress installations using the Canto plugin version 3.1.1 or earlier. The plugin author, flightbycanto, is the identified vendor, and the vulnerability affects all minor releases up to and including 3.1.1. No specific version numbers beyond the maximum are listed, so any deployment of 3.1.1 or older remains susceptible.

The CVSS v3 score of 5.3 indicates moderate severity, yet the lack of authentication checks makes exploitation straightforward. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog. Attackers can exploit the flaw remotely by sending crafted POST requests to copy‑media.php, bypassing all authorisation controls and uploading files of their choosing. The risk profile is therefore moderate to high, contingent on the attacker’s capability to deliver a malicious file that is allowed by the MIME filter. Proper mitigation is essential to prevent potential code execution or other damage.