Canto - Remote File Inclusion (CVE-2023-3452)
Description
The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.
psychologyCrowdSec Analysis
CVE-2023-3452 is a critical vulnerability in the Canto WordPress plugin that allows unauthenticated attackers to perform Remote File Inclusion via the 'wp_abspath' parameter in versions up to 3.0.4. If exploited, this flaw can enable remote code execution on the server, potentially leading to full system compromise, especially when allow_url_include is enabled. Local File Inclusion is also possible, increasing the risk if attackers can upload malicious files to the server. This vulnerability poses a severe threat to affected WordPress sites, making immediate patching essential.
CrowdSec has been tracking this vulnerability and its exploits since 30th of March 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2023-3452 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the Canto WordPress plugin by sending requests to /wp-content/plugins/canto/includes/lib/download.php with a crafted wp_abspath parameter, enabling remote file inclusion and potential remote code execution.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2023-08-12 |
| Rule Released | 2026-03-30 |
| CrowdSec First Seen | 2026-08-18 |