Vulnerabilities and security researches forcanto canto

Apr 19, 2026

CVE, Research URL: CVE-2026-6441
Home page URL: Security reports for Canto
Application: Canto
Date: Apr 17, 2026
Research Description: The Canto plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 3.1.1. This is due to the absence of any capability check or nonce verification in the updateOptions() function, which is exposed via two AJAX hooks: wp_ajax_updateOptions (class-canto.php line 231) and wp_ajax_fbc_updateOptions (class-canto-settings.php line 76). Both hooks are registered exclusively under the wp_ajax_ prefix (requiring only a logged-in user), with no call to current_user_can() or check_ajax_referer(). This makes it possible for authenticated attackers with subscriber-level access and above to arbitrarily modify or delete plugin options controlling cron scheduling behavior (fbc_duplicates, fbc_cron, fbc_schedule, fbc_cron_time_day, fbc_cron_time_hour, fbc_cron_start) and to manipulate or clear the plugin's scheduled WordPress cron event (fbc_scheduled_update).
Affected versions: max 3.1.1.
Status: vulnerable

Apr 13, 2026

CVE, Research URL: CVE-2026-3335
Home page URL: Security reports for Canto
Application: Canto
Date: Mar 21, 2026
Research Description: The Canto plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1 via the `/wp-content/plugins/canto/includes/lib/copy-media.php` file. This is due to the file being directly accessible without any authentication, authorization, or nonce checks, and the `fbc_flight_domain` and `fbc_app_api` URL components being accepted as user-supplied POST parameters rather than read from admin-configured options. Since the attacker controls both the destination server and the `fbc_app_token` value, the entire fetch-and-upload chain is attacker-controlled — the server never contacts Canto's legitimate API, and the uploaded file originates entirely from the attacker's infrastructure. This makes it possible for unauthenticated attackers to upload arbitrary files (constrained to WordPress-allowed MIME types) to the WordPress uploads directory. Additional endpoints (`detail.php`, `download.php`, `get.php`, `tree.php`) are also directly accessible without authentication and make requests using a user-supplied `app_api` parameter combined with an admin-configured subdomain.
Affected versions: max 3.1.1.
Status: vulnerable

Jun 17, 2024

CVE, Research URL: CVE-2024-4936
Home page URL: Security reports for Canto
Application: Canto
Date: Jun 14, 2024
Research Description: The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allow_url_include to be enabled on the target site in order to exploit.
Affected versions: max 3.0.9.
Status: vulnerable

Jun 10, 2024

CVE, Research URL: CVE-2020-28978
Home page URL: Security reports for Canto
Application: Canto
Date: Nov 30, 2020
Research Description: The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/tree.php?subdomain=SSRF.
Affected versions: max 2.0.1.
Status: vulnerable

CVE, Research URL: CVE-2024-25096
Home page URL: Security reports for Canto
Application: Canto
Date: Apr 03, 2024
Research Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: from n/a through 3.0.7.
Affected versions: max 3.0.7.
Status: vulnerable

CVE, Research URL: CVE-2023-3452
Home page URL: Security reports for Canto
Application: Canto
Date: Aug 12, 2023
Research Description: The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.
Affected versions: max 3.0.5.
Status: vulnerable

CVE, Research URL: CVE-2020-24063
Home page URL: Security reports for Canto
Application: Canto
Date: Nov 11, 2020
Research Description: The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF.
Affected versions: max 2.1.1.
Status: vulnerable

CVE, Research URL: CVE-2020-28976
Home page URL: Security reports for Canto
Application: Canto
Date: Nov 30, 2020
Research Description: The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain=SSRF.
Affected versions: max 2.0.1.
Status: vulnerable

CVE, Research URL: CVE-2020-28977
Home page URL: Security reports for Canto
Application: Canto
Date: Nov 30, 2020
Research Description: The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/get.php?subdomain=SSRF.
Affected versions: max 2.0.1.
Status: vulnerable