CVE-2026-3335: 
WordPress vulnerability analysis and mitigation

CVE-2026-3335 is a Missing Authorization vulnerability in the Canto plugin for WordPress, affecting all versions up to and including 3.1.1. The flaw allows unauthenticated remote attackers to upload arbitrary files (constrained to WordPress-allowed MIME types) to the WordPress uploads directory by directly accessing the unprotected copy-media.php endpoint. It was disclosed on March 21, 2026, by Wordfence, and carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, NVD).

The root cause is CWE-862 (Missing Authorization): the file /wp-content/plugins/canto/includes/lib/copy-media.php is directly web-accessible with no authentication, authorization, or nonce checks in place. The fbc_flight_domain and fbc_app_api URL components are accepted as attacker-supplied POST parameters rather than being read from admin-configured options, meaning the attacker fully controls the destination server and the fbc_app_token value — the WordPress server never contacts Canto's legitimate API, and the fetched file originates entirely from attacker-controlled infrastructure. Additional endpoints (detail.php, download.php, get.php, tree.php) are also directly accessible without authentication and accept a user-supplied app_api parameter. Vulnerable source code is publicly browsable in the WordPress plugin repository (NVD, Wordfence).

Successful exploitation allows unauthenticated attackers to inject attacker-controlled files into the WordPress uploads directory, limited to MIME types permitted by WordPress (e.g., images, documents, media files — not arbitrary PHP). While direct remote code execution via this vector is constrained by WordPress MIME type filtering, uploaded files could be leveraged in chained attacks, content defacement, or as staging material for further exploitation. The integrity of the WordPress media library is directly affected, and the server acts as an unwitting proxy fetching content from attacker infrastructure (Wordfence, NVD).

No public exploit code or active in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability requires no authentication and has low attack complexity, making it trivially exploitable by any network-accessible attacker. The EPSS score is approximately 0.121%, indicating a low but non-zero probability of exploitation in the near term. CVE-2026-3335 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Canto plugin (versions ≤ 3.1.1) using tools like WPScan, Shodan, or by checking /wp-content/plugins/canto/ for directory listings or plugin metadata.
2. Confirm endpoint accessibility: Send a direct HTTP request to https://target.example.com/wp-content/plugins/canto/includes/lib/copy-media.php to confirm the file is web-accessible without authentication.
3. Set up attacker-controlled server: Host a file of a WordPress-allowed MIME type (e.g., a JPEG or PDF) on an attacker-controlled server, and configure it to respond to the fetch request with the desired payload.
4. Craft malicious POST request: Send a POST request to the vulnerable endpoint with attacker-controlled fbc_flight_domain, fbc_app_api, and fbc_app_token parameters pointing to the attacker's server and file.
5. Trigger file upload: The WordPress server fetches the file from the attacker's infrastructure and writes it to the WordPress uploads directory (/wp-content/uploads/).
6. Retrieve uploaded file: Access the uploaded file via its public URL in the WordPress uploads directory for use in further attack chains (Wordfence, NVD).

• Network: Unexpected outbound HTTP/HTTPS requests from the WordPress server to unknown external hosts (attacker-controlled infrastructure) originating from the web server process; inbound POST requests to /wp-content/plugins/canto/includes/lib/copy-media.php, detail.php, download.php, get.php, or tree.php from unauthenticated sources.
• File System: Unexpected or anomalous files appearing in /wp-content/uploads/ with timestamps not corresponding to legitimate user activity; files with mismatched MIME types or unusual naming conventions in the uploads directory.
• Logs: Web server access logs showing direct POST requests to /wp-content/plugins/canto/includes/lib/copy-media.php without a valid WordPress session cookie or nonce; repeated requests to the additional unauthenticated endpoints (detail.php, download.php, get.php, tree.php) with app_api parameters pointing to external hosts.

Update the Canto plugin to version 3.1.2 or later, which addresses the missing authorization controls in the affected endpoints. As an interim workaround, administrators can block direct web access to the vulnerable PHP files via server-level rules (e.g., Apache .htaccess or Nginx location blocks denying access to copy-media.php, detail.php, download.php, get.php, and tree.php). Additionally, monitoring outbound HTTP requests from the web server process and reviewing the WordPress uploads directory for unexpected files is recommended until patching is complete (Wordfence).

Wordfence, the CNA that assigned and disclosed this CVE, published the vulnerability details on March 21, 2026. The vulnerability was also indexed by ENISA's European Vulnerability Database (EUVD-2026-14013) and tracked by multiple threat intelligence aggregators including Radar OffSeq and VulDB shortly after disclosure. No notable independent researcher commentary or significant social media discussion has been identified beyond standard CVE tracking activity.