CVE-2026-0604: 
WordPress vulnerability analysis and mitigation

CVE-2026-0604 is a Path Traversal vulnerability in the FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress, affecting all versions up to and including 2.7. The flaw resides in the dir_path parameter of the njt-fastdup/v1/template/directory-tree REST API endpoint, allowing authenticated attackers with Contributor-level access or above to read the contents of arbitrary directories on the server. It was disclosed on January 5–6, 2026, with Wordfence as the reporting CNA. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory – Path Traversal). The affected code is located in includes/Endpoint/TemplateApi.php at line 219, where the dir_path parameter passed to the njt-fastdup/v1/template/directory-tree REST API endpoint is not properly sanitized or restricted to an allowed base directory. An attacker with at least Contributor-level WordPress credentials can supply path traversal sequences (e.g., ../../) in the dir_path parameter to navigate outside the intended directory and enumerate or read the contents of arbitrary server directories. No user interaction is required beyond authentication, and attack complexity is low (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker to read the contents of arbitrary directories on the web server, potentially exposing sensitive files such as WordPress configuration files (wp-config.php), environment files containing database credentials, API keys, or other secrets stored on the filesystem. The impact is limited to confidentiality — there is no direct integrity or availability impact. However, exposed credentials or configuration data could enable further attacks, including database compromise or lateral movement within the hosting environment (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.04%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities, though Contributor accounts are commonly available on multi-author WordPress sites (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the FastDup plugin (versions ≤ 2.7) by checking plugin metadata via the WordPress REST API (/wp-json/) or by inspecting page source for plugin-specific assets.
2. Obtain Contributor-level access: Register or compromise a Contributor-level (or higher) WordPress account on the target site. Many WordPress sites allow open registration with Contributor roles.
3. Authenticate: Obtain a valid authentication token or session cookie by logging in via /wp-login.php or the REST API authentication endpoint.
4. Craft malicious REST API request: Send an authenticated HTTP GET or POST request to the endpoint njt-fastdup/v1/template/directory-tree with a manipulated dir_path parameter containing path traversal sequences, e.g., dir_path=../../../../../../etc or dir_path=../../wp-config.php.
5. Read directory contents: Parse the API response, which will return the directory listing or file contents of the traversed path, potentially exposing sensitive configuration files, credentials, or other server data (Wordfence, WordPress Trac).

• Network: Unusual authenticated REST API requests to /wp-json/njt-fastdup/v1/template/directory-tree with dir_path values containing ../ sequences or absolute paths outside the WordPress root directory.
• Logs: Web server access logs (Apache/Nginx) showing repeated GET/POST requests to the FastDup REST API endpoint from a single authenticated user, especially with encoded traversal sequences (%2e%2e%2f, ..%2f, %2e%2e/).
• Logs: WordPress debug logs or server logs showing directory listing responses for paths outside the WordPress installation directory (e.g., /etc/, /var/, /home/).
• File System: No direct file system artifacts are expected from read-only directory traversal, but subsequent attacker actions (e.g., using exposed credentials) may result in unauthorized file modifications or new admin accounts.

Users should update the FastDup plugin to a version beyond 2.7 that includes a fix for this vulnerability; the patch was committed to the plugin repository (changeset 3432226) and is reflected in the trunk version of TemplateApi.php. Site administrators should review WordPress user roles and limit Contributor-level registrations to trusted users only. As an interim workaround, consider disabling the FastDup plugin until a patched release is confirmed, or restrict REST API access to authenticated users with higher privilege levels via a security plugin or server-level rules (Wordfence, WordPress Trac Changeset).

Wordfence, the reporting CNA, included this vulnerability in their weekly WordPress vulnerability report for January 5–11, 2026, highlighting it as part of a broader set of plugin vulnerabilities disclosed that week (Wordfence Blog). No significant independent researcher commentary or notable social media discussion has been identified beyond standard aggregator coverage on platforms such as VulDB, Vulners, and CVEFeed.