What is the CVSS score of CVE-2026-3335?

CVE-2026-3335 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-3335?

Organizations using for WordPress is vulnerable to Missing Authorization in all should be aware of moderate risk from CVE-2026-3335, a missing authorization vulnerability rated CVSS 5.3.

How to fix or mitigate CVE-2026-3335?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Missing Authorization in all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-3335

EUVD-2026-14013 MEDIUM

Missing Authorization (CWE-862)

2026-03-21 Wordfence

GHSA-4jw9-5hrc-m4j6

GHSA-5f7v-4f6g-74rj

GHSA-j9m2-xx67-38fc

GHSA-mcj5-6qr4-95fj

GHSA-xgxp-f695-6vrp

WordPress PHP Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14013

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 5.3

DescriptionCVE.org

The Canto plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1 via the /wp-content/plugins/canto/includes/lib/copy-media.php file. This is due to the file being directly accessible without any authentication, authorization, or nonce checks, and the fbc_flight_domain and fbc_app_api URL components being accepted as user-supplied POST parameters rather than read from admin-configured options. Since the attacker controls both the destination server and the fbc_app_token value, the entire fetch-and-upload chain is attacker-controlled - the server never contacts Canto's legitimate API, and the uploaded file originates entirely from the attacker's infrastructure. This makes it possible for unauthenticated attackers to upload arbitrary files (constrained to WordPress-allowed MIME types) to the WordPress uploads directory. Additional endpoints (detail.php, download.php, get.php, tree.php) are also directly accessible without authentication and make requests using a user-supplied app_api parameter combined with an admin-configured subdomain.

AnalysisAI

The Canto plugin for WordPress (versions up to 3.1.1) contains a critical missing authorization vulnerability in the copy-media.php file and related endpoints that allows unauthenticated attackers to upload arbitrary files to the WordPress uploads directory. The vulnerability stems from multiple PHP files being directly accessible without authentication, nonce validation, or authorization checks, while also accepting attacker-controlled parameters for API endpoints and domain configuration. An attacker can exploit this to upload malicious files (within WordPress MIME type constraints) or redirect legitimate file operations to attacker-controlled infrastructure, potentially leading to remote code execution or site compromise.

Technical ContextAI

The Canto plugin (identified by CPE cpe:2.3:a:flightbycanto:canto:*:*:*:*:*:*:*:*) is a WordPress plugin designed to integrate with the Canto digital asset management system. The vulnerability exists in multiple PHP files including /wp-content/plugins/canto/includes/lib/copy-media.php, detail.php, download.php, get.php, and tree.php. The root cause is classified as CWE-862 (Missing Authorization), where the plugin accepts user-supplied POST parameters for critical configuration values (fbc_flight_domain, fbc_app_api, app_api) instead of reading them from secure admin-configured options. This allows attackers to control both the destination server and authentication tokens, bypassing the intended Canto API integration entirely. The vulnerability is compounded by the absence of nonce checks and the fact that these files are directly web-accessible, making them exploitable without requiring any WordPress user privileges.

RemediationAI

Immediately upgrade the Canto plugin to a patched version released after 3.1.1 (check the plugin's release page for the latest secure version). Until an upgrade is available or deployed, disable the Canto plugin entirely to prevent exploitation. As a network-level mitigation, restrict direct access to the /wp-content/plugins/canto/includes/lib/ directory by adding WordPress security rules (via web server configuration or security plugins) to block requests to these specific PHP files except from authenticated admin contexts. Implement Web Application Firewall (WAF) rules to block POST requests to copy-media.php, detail.php, download.php, get.php, and tree.php that originate from non-authenticated sources. Audit your WordPress uploads directory for any suspicious files uploaded since the plugin's installation date. Review WordPress configuration to ensure the uploads directory does not have PHP execution enabled (verify .htaccess or nginx configuration). For additional protection, enforce rate limiting on the plugin's endpoints and monitor file uploads for anomalies. See the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0777f759-6980-4572-a866-0210bd5f5085?source=cve for detailed mitigation recommendations and patched version availability.