The Canto plugin for WordPress suffers from a Remote File Inclusion vulnerability (CWE-98) in all versions up to 3.0.8. This flaw arises from improper control of the filename used in an include/require statement, specifically via the abspath parameter. If the PHP setting allow_url_include is enabled, an unauthenticated attacker can exploit this to include and execute remote code on the server. This vulnerability is rated critical with a CVSS 3.1 base score of 9.8, reflecting its network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to remote code execution on the affected server, compromising confidentiality, integrity, and availability of the system. Because no authentication is required, the vulnerability poses a significant risk if the PHP configuration allow_url_include is enabled. There are no known active exploits reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to ensure that the PHP configuration directive allow_url_include is disabled (which is the default in most environments) to prevent exploitation. Monitor vendor channels for updates or patches addressing this vulnerability.