CVE-2026-3335: CWE-862 Missing Authorization in flightbycanto Canto
The Canto plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1 via the `/wp-content/plugins/canto/includes/lib/copy-media.php` file. This is due to the file being directly accessible without any authentication, authorization, or nonce checks, and the `fbc_flight_domain` and `fbc_app_api` URL components being accepted as user-supplied POST parameters rather than read from admin-configured options. Since the attacker controls both the destination server and the `fbc_app_token` value, the entire fetch-and-upload chain is attacker-controlled — the server never contacts Canto's legitimate API, and the uploaded file originates entirely from the attacker's infrastructure. This makes it possible for unauthenticated attackers to upload arbitrary files (constrained to WordPress-allowed MIME types) to the WordPress uploads directory. Additional endpoints (`detail.php`, `download.php`, `get.php`, `tree.php`) are also directly accessible without authentication and make requests using a user-supplied `app_api` parameter combined with an admin-configured subdomain.
AI Analysis
Technical Summary
CVE-2026-3335 is a missing authorization vulnerability (CWE-862) in the flightbycanto Canto WordPress plugin versions up to 3.1.1. The vulnerability exists because critical PHP files such as /wp-content/plugins/canto/includes/lib/copy-media.php are directly accessible without authentication or nonce checks. User-supplied POST parameters like fbc_flight_domain and fbc_app_api override admin-configured options, allowing attackers to control the file upload source and destination. This enables unauthenticated attackers to upload arbitrary files limited to WordPress-allowed MIME types to the WordPress uploads directory. Additional endpoints (detail.php, download.php, get.php, tree.php) also lack proper authorization and accept user-controlled parameters combined with admin subdomains, further exposing the plugin to unauthorized access and manipulation.
Potential Impact
An unauthenticated attacker can upload arbitrary files to the WordPress uploads directory, constrained only by WordPress-allowed MIME types. This could lead to unauthorized file uploads that may facilitate further attacks such as webshell deployment or content manipulation. The vulnerability does not impact confidentiality or availability directly but allows integrity compromise via unauthorized file uploads. There are no known exploits in the wild as of the published date.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is referenced, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the affected plugin files via web server configuration or disabling the plugin may reduce exposure. Avoid using the affected versions of the Canto plugin in production environments.
CVE-2026-3335: CWE-862 Missing Authorization in flightbycanto Canto
Description
The Canto plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1 via the `/wp-content/plugins/canto/includes/lib/copy-media.php` file. This is due to the file being directly accessible without any authentication, authorization, or nonce checks, and the `fbc_flight_domain` and `fbc_app_api` URL components being accepted as user-supplied POST parameters rather than read from admin-configured options. Since the attacker controls both the destination server and the `fbc_app_token` value, the entire fetch-and-upload chain is attacker-controlled — the server never contacts Canto's legitimate API, and the uploaded file originates entirely from the attacker's infrastructure. This makes it possible for unauthenticated attackers to upload arbitrary files (constrained to WordPress-allowed MIME types) to the WordPress uploads directory. Additional endpoints (`detail.php`, `download.php`, `get.php`, `tree.php`) are also directly accessible without authentication and make requests using a user-supplied `app_api` parameter combined with an admin-configured subdomain.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-3335 is a missing authorization vulnerability (CWE-862) in the flightbycanto Canto WordPress plugin versions up to 3.1.1. The vulnerability exists because critical PHP files such as /wp-content/plugins/canto/includes/lib/copy-media.php are directly accessible without authentication or nonce checks. User-supplied POST parameters like fbc_flight_domain and fbc_app_api override admin-configured options, allowing attackers to control the file upload source and destination. This enables unauthenticated attackers to upload arbitrary files limited to WordPress-allowed MIME types to the WordPress uploads directory. Additional endpoints (detail.php, download.php, get.php, tree.php) also lack proper authorization and accept user-controlled parameters combined with admin subdomains, further exposing the plugin to unauthorized access and manipulation.
Potential Impact
An unauthenticated attacker can upload arbitrary files to the WordPress uploads directory, constrained only by WordPress-allowed MIME types. This could lead to unauthorized file uploads that may facilitate further attacks such as webshell deployment or content manipulation. The vulnerability does not impact confidentiality or availability directly but allows integrity compromise via unauthorized file uploads. There are no known exploits in the wild as of the published date.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is referenced, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the affected plugin files via web server configuration or disabling the plugin may reduce exposure. Avoid using the affected versions of the Canto plugin in production environments.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-02-27T15:12:19.844Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69be180ef4197a8e3b78433c
Added to database: 3/21/2026, 4:01:18 AM
Last enriched: 4/9/2026, 10:07:36 PM
Last updated: 5/5/2026, 5:09:30 PM
Views: 41
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.