PT-2026-8073 · WordPress · Midi-Synth

Athiwat Tiprasaharn + 4 · Published 2026-02-14 · Updated 2026-03-24 · CVE-2026-1306

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions midi-Synth plugin for WordPress versions up to and including 1.1.0

Description The midi-Synth plugin for WordPress is susceptible to arbitrary file uploads because of a lack of validation for file types and extensions within the 'export' AJAX action. This allows unauthenticated attackers to upload files to the affected server. Successful exploitation, which requires obtaining a valid nonce, could potentially lead to remote code execution. The nonce is exposed in frontend JavaScript, making it easily accessible to attackers.

API Endpoint: '/export' Vulnerable Parameter: No specific parameters are mentioned, but the issue relates to file uploads handled by the 'export' AJAX action. Vulnerable Function: The 'export' AJAX action is vulnerable.

Recommendations Update the midi-Synth plugin to a version newer than 1.1.0. Disable the midi-Synth plugin if an update is not available.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-1306

Affected Products

Midi-Synth

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2026-1306 · Security Note
• https://plugins.trac.wordpress.org/browser/midi-synth/tags/1.1.0/midiSynth.php#L110 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3460788%40midi-synth&new=3460788%40midi-synth&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/midi-synth/tags/1.1.0/midiSynth.php#L121 · Note
• https://plugins.trac.wordpress.org/browser/midi-synth/tags/1.1.0/midiSynthConvert.php#L492 · Note
• https://twitter.com/TheHackerWire/status/2022580571390771582 · Twitter Post
• https://twitter.com/0dayPublishing/status/2023156432573473058 · Twitter Post
• https://twitter.com/CVEnew/status/2022567891225411950 · Twitter Post
• https://twitter.com/CveFindCom/status/2022584460789629166 · Twitter Post
• https://t.me/CVEtracker/44697 · Telegram Post
• https://plugins.trac.wordpress.org/browser/midi-synth/tags/1.1.0/midiSynthConvert.php#L421 · Note
• https://twitter.com/offseq/status/2022574069816660294 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/2036261752846102637 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d5b695d7-c690-4748-b218-5699d1aa63bf?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2022686335899775073 · Twitter Post