midi-Synth: Unauthenticated arbitrary file upload remote code execution (CVE-2026-1306)

The midi-Synth WordPress plugin contains a critical unauthenticated arbitrary file upload vulnerability (CVE-2026-1306) in the export AJAX handler of admin-ajax.php. The plugin fails to validate file extensions, MIME types, or file content, allowing unauthenticated users to upload malicious files to the /wp-content/plugins/midi-synth/sound/ directory. Because this directory is web-accessible and allows PHP execution, an attacker can achieve remote code execution (RCE). The vulnerability is remediated in version 2.0.0.

Attack Chain

1. Attacker performs a GET request to the WordPress homepage.
2. Attacker parses the HTML response to extract the hardcoded nonce (midiSynth_nonce) embedded in frontend JavaScript.
3. Attacker sends a POST request to /wp-admin/admin-ajax.php with action=export and the extracted nonce.
4. Attacker includes the filename (e.g., shell.php) and base64-encoded file content in the POST parameters.
5. The plugin decodes and writes the file to the web-accessible /wp-content/plugins/midi-synth/sound/ directory.
6. Attacker requests the newly uploaded PHP file via the browser to trigger code execution.

Impact

Successful exploitation allows for full server compromise, including loss of confidentiality, integrity, and availability of the affected WordPress site.

Recommendation

• Update the midi-Synth plugin to version 2.0.0 or later immediately.
• If updates cannot be applied, deactivate and remove the plugin from the environment.
• Audit the /wp-content/plugins/midi-synth/sound/ directory for unexpected files and remove any malicious entries.
• Implement a WAF rule to block POST requests to admin-ajax.php where action=export and the fileName parameter ends in .php.
• Review server access logs for anomalous POST requests to admin-ajax.php as defined in the hunt leads.