FastDup EUVD-2026-37004

Exploitation requires (a) a target WordPress site running FastDup at version 2.7.2 or earlier, (b) network reachability to that site's wp-admin or admin-ajax endpoint from the attacker's vantage point, and (c) a logged-in WordPress user - almost certainly an administrator, since FastDup is a backup/migration plugin whose file endpoints are normally gated to manage_options-capable users - to interact with the attacker-supplied URL (UI:R in the CVSS vector). The 'unauthenticated' wording in the description refers to the request itself carrying no attacker-supplied credentials; the limiting factor is the victim's session, meaning sites where administrators are trained against link-clicking, or where wp-admin is IP-restricted, face materially lower exploitation likelihood than the raw 9.6 score suggests.

Signals are mixed but lean toward prioritisation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) indicates an internet-reachable, low-complexity, unauthenticated bug whose impact crosses a trust boundary; that combination is unusual and is what drives the 9.6 score. However, UI:R means a logged-in WordPress user (often an administrator, given typical FastDup permission gating) must click a crafted link, which materially limits opportunistic mass exploitation. KEV status is not listed and no EPSS score or SSVC decision was provided in the input, and no public PoC is referenced. The vendor advisory route is Patchstack only, with no NVD or vendor changelog cross-reference in the data given, so the 'unauthenticated' label in the description should be interpreted alongside UI:R: it is auth-less at the HTTP layer but socially-gated in practice.

An attacker hosts a page or sends a phishing email containing a link to the victim's own WordPress site that triggers FastDup's vulnerable file-handling endpoint with a path-traversal payload (e.g. ..%2f..%2fwp-config.php). When a logged-in WordPress administrator clicks the link, their authenticated session is used to read sensitive files such as wp-config.php (yielding database credentials and auth keys) or to write a PHP webshell into the webroot, resulting in full site takeover. No public exploit identified at time of analysis, but the bug class is mechanically trivial once the vulnerable parameter is known.