Midi-Synth (< 2.0.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/midi-synth--2.0.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 18:15:53 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgmidi-Synth: Unauthenticated arbitrary file upload remote code execution (CVE-2026-1306)https://feed.craftedsignal.io/briefs/2026-10-midi-synth-rce/Tue, 27 Oct 2026 18:15:53 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-midi-synth-rce/A critical unauthenticated arbitrary file upload vulnerability in the WordPress plugin midi-Synth (CVE-2026-1306) allows remote attackers to achieve full server compromise by uploading and executing arbitrary PHP files via the admin-ajax.php endpoint.The midi-Synth WordPress plugin contains a critical unauthenticated arbitrary file upload vulnerability (CVE-2026-1306) in the export AJAX handler of admin-ajax.php. The plugin fails to validate file extensions, MIME types, or file content, allowing unauthenticated users to upload malicious files to the /wp-content/plugins/midi-synth/sound/ directory. Because this directory is web-accessible and allows PHP execution, an attacker can achieve remote code execution (RCE). The vulnerability is remediated in version 2.0.0.

Attack Chain

  1. Attacker performs a GET request to the WordPress homepage.
  2. Attacker parses the HTML response to extract the hardcoded nonce (midiSynth_nonce) embedded in frontend JavaScript.
  3. Attacker sends a POST request to /wp-admin/admin-ajax.php with action=export and the extracted nonce.
  4. Attacker includes the filename (e.g., shell.php) and base64-encoded file content in the POST parameters.
  5. The plugin decodes and writes the file to the web-accessible /wp-content/plugins/midi-synth/sound/ directory.
  6. Attacker requests the newly uploaded PHP file via the browser to trigger code execution.

Impact

Successful exploitation allows for full server compromise, including loss of confidentiality, integrity, and availability of the affected WordPress site.

Recommendation

  • Update the midi-Synth plugin to version 2.0.0 or later immediately.
  • If updates cannot be applied, deactivate and remove the plugin from the environment.
  • Audit the /wp-content/plugins/midi-synth/sound/ directory for unexpected files and remove any malicious entries.
  • Implement a WAF rule to block POST requests to admin-ajax.php where action=export and the fileName parameter ends in .php.
  • Review server access logs for anomalous POST requests to admin-ajax.php as defined in the hunt leads.
]]>criticaladvisorywordpressarbitrary-file-uploadrceweb-application-vulnerability