Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-6441

The Canto plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 3.1.1. This is due to the absence of any capability check or nonce verification in the updateOptions() function, which is exposed via two AJAX hooks: wp_ajax_updateOptions (class-canto.php line 231) and wp_ajax_fbc_updateOptions (class-canto-settings.php line 76). Both hooks are registered exclusively under the wp_ajax_ prefix (requiring only a logged-in user), with no call to current_user_can()
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:3f0281cc44658960b3bb579d7c75a043bcfe73de9f264b68e0abb1f1a3cf97b3
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"defaultStatus":"unaffected","product":"Canto","vendor":"flightbycanto","versions":[{"lessThanOrEqual":"3.1.1","status":"affected","version":"0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:534655323368fd1a269409457fb0a799cc83770b839647f67b1ba703cb89ede9 · sha256:e377c75f3a3118ce… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:534655323368fd1a269409457fb0a799cc83770b839647f67b1ba703cb89ede9 · sha256:e377c75f3a3118ce… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:534655323368fd1a269409457fb0a799cc83770b839647f67b1ba703cb89ede9 · sha256:e377c75f3a3118ce… · /containers/cna/problemTypes/0/descriptions/0

Source references

7 source assertions
{"url":"https://plugins.trac.wordpress.org/browser/canto/tags/3.1.1/includes/class-canto-settings.php#L603"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:534655323368fd1a269409457fb0a799cc83770b839647f67b1ba703cb89ede9 · sha256:e377c75f3a3118ce… · /containers/cna/references/6
{"url":"https://plugins.trac.wordpress.org/browser/canto/tags/3.1.1/includes/class-canto.php#L231"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:534655323368fd1a269409457fb0a799cc83770b839647f67b1ba703cb89ede9 · sha256:e377c75f3a3118ce… · /containers/cna/references/4
{"url":"https://plugins.trac.wordpress.org/browser/canto/tags/3.1.1/includes/class-canto.php#L572"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:534655323368fd1a269409457fb0a799cc83770b839647f67b1ba703cb89ede9 · sha256:e377c75f3a3118ce… · /containers/cna/references/2
{"url":"https://plugins.trac.wordpress.org/browser/canto/trunk/includes/class-canto-settings.php#L603"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:534655323368fd1a269409457fb0a799cc83770b839647f67b1ba703cb89ede9 · sha256:e377c75f3a3118ce… · /containers/cna/references/5
{"url":"https://plugins.trac.wordpress.org/browser/canto/trunk/includes/class-canto.php#L231"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:534655323368fd1a269409457fb0a799cc83770b839647f67b1ba703cb89ede9 · sha256:e377c75f3a3118ce… · /containers/cna/references/3
{"url":"https://plugins.trac.wordpress.org/browser/canto/trunk/includes/class-canto.php#L572"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:534655323368fd1a269409457fb0a799cc83770b839647f67b1ba703cb89ede9 · sha256:e377c75f3a3118ce… · /containers/cna/references/1
{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1a0200f-9861-4eca-adbf-d458eb6b4e63?source=cve"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:534655323368fd1a269409457fb0a799cc83770b839647f67b1ba703cb89ede9 · sha256:e377c75f3a3118ce… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer