PT-2026-33415 · WordPress · Canto

Abhirup Konwar

·

Published

2026-04-17

·

Updated

2026-04-24

·

CVE-2026-6441

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Canto plugin for WordPress versions prior to 3.1.2
Description Missing authorization occurs due to the absence of capability checks or nonce verification in the updateOptions() function. This function is exposed via two AJAX hooks: 'wp ajax updateOptions' and 'wp ajax fbc updateOptions'. Because these hooks are registered under the wp ajax prefix without calls to current user can() or check ajax referer(), authenticated attackers with subscriber-level access or higher can arbitrarily modify or delete plugin options that control cron scheduling behavior, specifically fbc duplicates, fbc cron, fbc schedule, fbc cron time day, fbc cron time hour, and fbc cron start. Additionally, attackers can manipulate or clear the scheduled WordPress cron event fbc scheduled update.
Recommendations Update to a version later than 3.1.1. As a temporary workaround, restrict access to the updateOptions() function or the associated AJAX hooks until a patch is applied.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-6441

Affected Products

Canto