CVE-2026-6441: Missing Authorization

The Canto plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 3.1.1. This is due to the absence of any capability check or nonce verification in the updateOptions function, which is exposed via two AJAX hooks: wpajaxupdateOptions class-canto.php line 231 an...

CVE-2026-3335: Missing Authorization

The Canto plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1 via the /wp-content/plugins/canto/includes/lib/copy-media.php file. This is due to the file being directly accessible without any authentication, authorization, or nonce checks, and t...

PT-2020-17074

Name of the Vulnerable Software and Affected Versions Canto plugin version 1.3.0 for WordPress Description The issue allows an unauthenticated attacker to make a request to any internal and external server via the /includes/lib/detail.php endpoint with the subdomain variable set to SSRF. This...

PT-2020-17075

Name of the Vulnerable Software and Affected Versions Canto plugin version 1.3.0 for WordPress Description The issue allows an unauthenticated attacker to make a request to any internal and external server via the /includes/lib/get.php endpoint with the subdomain variable set to SSRF. This enable...

PT-2020-17076

Name of the Vulnerable Software and Affected Versions Canto plugin version 1.3.0 for WordPress Description The issue allows an unauthenticated attacker to make a request to any internal and external server via the /includes/lib/tree.php endpoint with the subdomain variable set to SSRF. This enabl...

PT-2020-15635

Name of the Vulnerable Software and Affected Versions Canto plugin version 1.3.0 for WordPress Description The issue allows for Server-Side Request Forgery SSRF via the "includes/lib/download.php" endpoint with the subdomain parameter. Recommendations For Canto plugin version 1.3.0, consider...