# CVE-2023-3452: Canto - Remote File Inclusion

> Live exploitation tracking for CVE-2023-3452 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-3452

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Flightbycanto Canto
- **Weaknesses:** CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'))
- **Tags:** wordpress, cms

## Description

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.

## CrowdSec analysis

[CVE-2023-3452](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-3452) is a critical vulnerability in the Canto WordPress plugin that allows unauthenticated attackers to perform Remote File Inclusion via the 'wp_abspath' parameter in versions up to 3.0.4. If exploited, this flaw can enable remote code execution on the server, potentially leading to full system compromise, especially when allow_url_include is enabled. Local File Inclusion is also possible, increasing the risk if attackers can upload malicious files to the server. This vulnerability poses a severe threat to affected WordPress sites, making immediate patching essential.

CrowdSec has been tracking this vulnerability and its exploits since 30th of March 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2023-3452 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the Canto WordPress plugin by sending requests to `/wp-content/plugins/canto/includes/lib/download.php` with a crafted `wp_abspath` parameter, enabling remote file inclusion and potential remote code execution.

## Timeline

- 2023-08-12: CVE Published. CVE-2023-3452 is published to NVD.
- 2026-03-30: Rule Released. CrowdSec releases a rule to detect CVE-2023-3452 exploitation attempts against the CrowdSec Network.
- 2026-08-18: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2023-3452 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3452.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-3452) follows observed exploitation activity for CVE-2023-3452. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.