{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amidi-synth_projectmidi-synthwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:midi-synth_project:midi-synth:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-1306"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["midi-Synth (\u003c 2.0.0)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","arbitrary-file-upload","rce","web-application-vulnerability"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe midi-Synth WordPress plugin contains a critical unauthenticated arbitrary file upload vulnerability (CVE-2026-1306) in the export AJAX handler of admin-ajax.php. The plugin fails to validate file extensions, MIME types, or file content, allowing unauthenticated users to upload malicious files to the /wp-content/plugins/midi-synth/sound/ directory. Because this directory is web-accessible and allows PHP execution, an attacker can achieve remote code execution (RCE). The vulnerability is remediated in version 2.0.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs a GET request to the WordPress homepage.\u003c/li\u003e\n\u003cli\u003eAttacker parses the HTML response to extract the hardcoded nonce (\u003ccode\u003emidiSynth_nonce\u003c/code\u003e) embedded in frontend JavaScript.\u003c/li\u003e\n\u003cli\u003eAttacker sends a POST request to /wp-admin/admin-ajax.php with action=export and the extracted nonce.\u003c/li\u003e\n\u003cli\u003eAttacker includes the filename (e.g., shell.php) and base64-encoded file content in the POST parameters.\u003c/li\u003e\n\u003cli\u003eThe plugin decodes and writes the file to the web-accessible /wp-content/plugins/midi-synth/sound/ directory.\u003c/li\u003e\n\u003cli\u003eAttacker requests the newly uploaded PHP file via the browser to trigger code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full server compromise, including loss of confidentiality, integrity, and availability of the affected WordPress site.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the midi-Synth plugin to version 2.0.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf updates cannot be applied, deactivate and remove the plugin from the environment.\u003c/li\u003e\n\u003cli\u003eAudit the /wp-content/plugins/midi-synth/sound/ directory for unexpected files and remove any malicious entries.\u003c/li\u003e\n\u003cli\u003eImplement a WAF rule to block POST requests to admin-ajax.php where action=export and the fileName parameter ends in .php.\u003c/li\u003e\n\u003cli\u003eReview server access logs for anomalous POST requests to admin-ajax.php as defined in the hunt leads.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T18:15:53Z","date_published":"2026-10-27T18:15:53Z","id":"https://feed.craftedsignal.io/briefs/2026-10-midi-synth-rce/","summary":"A critical unauthenticated arbitrary file upload vulnerability in the WordPress plugin midi-Synth (CVE-2026-1306) allows remote attackers to achieve full server compromise by uploading and executing arbitrary PHP files via the admin-ajax.php endpoint.","title":"midi-Synth: Unauthenticated arbitrary file upload remote code execution (CVE-2026-1306)","url":"https://feed.craftedsignal.io/briefs/2026-10-midi-synth-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:midi-Synth_project:midi-Synth:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}