/Vulnerability Library

WordPress Canto Plugin <= 3.0.4 - File Inclusion

CVE-2023-3452
Verified

Description

Canto plugin for WordPress up to version 3.0.4 contains a remote file inclusion caused by the 'wp_abspath' parameter, letting unauthenticated attackers include and execute arbitrary remote code if allow_url_include is enabled, exploit requires allow_url_include to be enabled.

Severity

Critical

CVSS Score

9.8

Exploit Probability

7%

Published Date

February 20, 2026

Template Author

omarkurt

CVE-2023-3452.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2023-3452
CWE ID:
cwe-98

References

https://www.exploit-db.com/exploits/51826https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/canto/canto-304-unauthenticated-remote-file-inclusionhttps://nvd.nist.gov/vuln/detail/CVE-2023-3452

Remediation Steps

Update to the latest version of the Canto plugin, above 3.0.4, or disable allow_url_include in PHP configuration.