What is the CVSS score of EUVD-2026-37004?

EUVD-2026-37004 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of FastDup are affected by EUVD-2026-37004?

FastDup WordPress plugin (through version 2.7.2) is vulnerable to a critical path traversal flaw that allows unauthenticated attackers to read and write arbitrary files on affected WordPress servers.

How to fix or mitigate EUVD-2026-37004?

Within 24 hours: Identify and deactivate FastDup plugin across all WordPress instances. Within 7 days: Monitor vendor advisories for patches and evaluate alternative plugins with active security maintenance. Within 30 days: Apply vendor patch immediately upon release or migrate to a patched alternative plugin.

FastDup EUVD-2026-37004

| CVE-2026-52703 CRITICAL

Path Traversal: '.../...//' (CWE-35)

2026-06-15 Patchstack

GHSA-4ch2-hcmc-wjw8

Path Traversal Fastdup

9.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Network-reachable WordPress endpoint (AV:N), trivial traversal payload (AC:L), no auth on the request itself (PR:N), victim admin click required (UI:R), plugin bug impacts WordPress core files (S:C, C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:23 vuln.today

DescriptionCVE.org

Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.

AnalysisAI

Path traversal in the FastDup WordPress plugin through version 2.7.2 allows remote attackers to read or write arbitrary files outside the plugin's intended directory after a single user interaction, with confidentiality, integrity, and availability impacts extending to the WordPress host (scope-changed, CVSS 9.6). The flaw is unauthenticated per the CVSS vector but requires a victim to trigger the malicious request, and no public exploit identified at time of analysis. Disclosure originates from Patchstack's WordPress vulnerability research program.

Technical ContextAI

FastDup is a WordPress backup/migration plugin published by ninja_team (CPE cpe:2.3:a:ninja_team:fastdup). The root cause is CWE-35 (Path Traversal: '.../...//'), a class of bug where an application sanitizer fails to collapse repeated or obfuscated traversal sequences before resolving a user-controlled path, allowing the resolved path to escape an intended base directory. In the WordPress plugin context this typically manifests in file-handling endpoints (download, restore, view, or extract handlers) that accept a filename parameter and concatenate it to a base path without canonicalisation, enabling access to wp-config.php, .htaccess, or arbitrary writes within the webroot. The CVSS Scope:Changed metric is consistent with this - traversal in a plugin reaches resources owned by WordPress core and the underlying filesystem.

RemediationAI

Patch availability is not confirmed from the input data; the advisory only specifies that versions 2.7.2 and earlier are vulnerable, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/fastdup/vulnerability/wordpress-fastdup-plugin-2-7-2-path-traversal-vulnerability) and the FastDup plugin page on wordpress.org for the latest release greater than 2.7.2 and upgrade to it once published. Until a fixed version is verified, deactivate and remove the FastDup plugin on production sites (trade-off: backup/migration workflow is lost and must be replaced with an alternative such as UpdraftPlus or a server-side tar/rsync job), or restrict access to the plugin's admin-ajax.php and wp-admin endpoints by source IP via a web application firewall or .htaccess allow-list (trade-off: legitimate admins outside the allow-list lose access). Because UI:R is in scope, also instruct administrators to avoid clicking links to their own WordPress admin URL received from untrusted sources until the plugin is removed or patched.