CVE-2024-4936

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allow_url_include to be enabled on the target site in order to exploit.

• CWE-98

• https://plugins.trac.wordpress.org/browser/canto/trunk/includes/lib/sizes.php#L15Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3105443%40canto&new=3104074%40canto&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/95a68ae0-36da-499b-a09d-4c91db8aa338?source=cvePatch, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/canto/trunk/includes/lib/sizes.php#L15Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/95a68ae0-36da-499b-a09d-4c91db8aa338?source=cvePatch, Third Party Advisory

Published

Jun 14, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-49353IBM Watson Speech Services Cartridge for IBM Cloud Pak for D…5.9
• CVE-2024-49354IBM Concert 1.0.0, 1.0.1, and 1.0.2 is vulnerable to sensiti…7.5
• CVE-2024-49355IBM OpenPages with Watson 8.3 and 9.0 may write improperly n…6.5
• CVE-2024-49357ZimaOS is a fork of CasaOS, an operating system for Zima dev…7.5
• CVE-2024-49358ZimaOS is a fork of CasaOS, an operating system for Zima dev…5.3
• CVE-2024-49359ZimaOS is a fork of CasaOS, an operating system for Zima dev…7.5
• CVE-2024-49360Sandboxie is a sandbox-based isolation software for 32-bit a…8.4
• CVE-2024-49361ACON is a widely-used library of tools for machine learning …8.1
• CVE-2024-49362Joplin is a free, open source note taking and to-do applicat…9.6
• CVE-2024-49363Misskey is an open source, federated social media platform. …7.4
• CVE-2024-49364tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior …8.1
• CVE-2024-49365tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior …8.1