What is the CVSS score of CVE-2026-6441?

CVE-2026-6441 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-6441

EUVD-2026-23382 MEDIUM

Missing Authorization (CWE-862)

2026-04-17 Wordfence

PHP Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 17, 2026 - 07:12 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 07:00 euvd

EUVD-2026-23382

Analysis Generated

Apr 17, 2026 - 07:00 vuln.today

CVE Published

Apr 17, 2026 - 06:44 nvd

MEDIUM 4.3

DescriptionCVE.org

The Canto plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 3.1.1. This is due to the absence of any capability check or nonce verification in the updateOptions() function, which is exposed via two AJAX hooks: wp_ajax_updateOptions (class-canto.php line 231) and wp_ajax_fbc_updateOptions (class-canto-settings.php line 76). Both hooks are registered exclusively under the wp_ajax_ prefix (requiring only a logged-in user), with no call to current_user_can() or check_ajax_referer(). This makes it possible for authenticated attackers with subscriber-level access and above to arbitrarily modify or delete plugin options controlling cron scheduling behavior (fbc_duplicates, fbc_cron, fbc_schedule, fbc_cron_time_day, fbc_cron_time_hour, fbc_cron_start) and to manipulate or clear the plugin's scheduled WordPress cron event (fbc_scheduled_update).

AnalysisAI

Authenticated attackers with subscriber-level WordPress access can bypass capability checks in the Canto plugin (versions up to 3.1.1) via unprotected AJAX endpoints to arbitrarily modify or delete critical plugin options controlling cron scheduling and disable scheduled update tasks. The vulnerability requires a logged-in user but accepts any authenticated account regardless of intended permissions, allowing privilege escalation of low-level accounts to perform administrative functions without authorization. No active exploitation confirmed; patch status not yet identified.

Technical ContextAI

The Canto plugin for WordPress implements two AJAX action handlers (updateOptions and fbc_updateOptions) that directly modify WordPress options via $_POST parameters without validating the caller's capabilities or verifying nonce tokens. WordPress AJAX endpoints registered with the wp_ajax_ prefix execute only for authenticated users (those with a valid WordPress session cookie), but the plugin fails to invoke current_user_can() to check role-based permissions or check_ajax_referer() to validate request authenticity. This violates the WordPress security best practice of capability-based authorization (CWE-862: Missing Authorization). The affected options control fbc_duplicates, fbc_cron, fbc_schedule, fbc_cron_time_day, fbc_cron_time_hour, fbc_cron_start, and the fbc_scheduled_update cron event itself, which are intended for administrative modification only. CPE cpe:2.3:a:flightbycanto:canto:*:*:*:*:*:*:*:* indicates the vulnerability affects all versions of the Canto plugin.

RemediationAI

Upgrade the Canto plugin to a version released after 3.1.1 that includes authorization checks (patch version not explicitly specified in available data; contact Flightbycanto or check WordPress plugin repository for the latest version). As a temporary workaround if upgrade is delayed, restrict WordPress user roles to remove Subscriber access from untrusted users, or implement network-level access controls to limit AJAX endpoint visibility to known administrator IP addresses (note: this mitigation is incomplete as it relies on network segmentation rather than plugin-level fixes). The definitive fix requires the plugin developers to add current_user_can('manage_options') checks before option modification in both updateOptions() functions and implement check_ajax_referer() to validate nonce tokens. For detailed vendor guidance, consult the Wordfence vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/c1a0200f-9861-4eca-adbf-d458eb6b4e63?source=cve.