CVE-2023-3452

CRITICAL 9.8

Canto <= 3.0.4 - Unauthenticated Remote File Inclusion

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.

CWE	CWE-98
Vendor	flightbycanto
Product	canto
Published	Aug 12, 2023
Last Updated	Apr 8, 2026

Stay Ahead of the Next One

Get instant alerts for flightbycanto canto

Be the first to know when new critical vulnerabilities affecting flightbycanto canto are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

flightbycanto / Canto

0 ≤ 3.0.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/a76077c6-700a-4d21-a930-b0d6455d959c?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/canto/trunk/includes/lib/tree.php?rev=2841358#L5 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/2951888/canto/trunk/includes/lib/tree.php

Credits

Marco Wotschka