CVE-2026-0604mediumCWE-22

CVE-2026-0604: falha de média gravidade em ninjateam FastDup – Fastest WordPress…

FastDup <= 2.7 - Authenticated (Contributor+) Path Traversal via 'dir_path' REST Parameter

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar FastDup – Fastest WordPress Migration & Duplicator

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.4%
The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.7 via the 'dir_path' parameter in the 'njt-fastdup/v1/template/directory-tree' REST API endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary directories on the server, which can contain sensitive information.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
ninjateam · FastDup – Fastest WordPress Migration & Duplicator
CVEs relacionadas — ninjateam FastDup – Fastest WordPress…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-1104HIGHFastDup – Fastest WordPress Migration & Duplicator <= 2.7.1 - Missing Authorization to Authenticated (Contributor+) Backup Creation and DownloadEPSS 0.3%