CVE-2026-6441

OVERVIEW CVE-2026-6441 is a Missing Authorization vulnerability affecting the Canto plugin for WordPress in versions up to and including 3.1.1. The vulnerability exists in the updateOptions() function, which is exposed through two AJAX hooks without proper capability or nonce verification. This allows authenticated users to arbitrarily modify or delete critical plugin options related to cron scheduling and WordPress cron event management. SEVERITY The vulnerability has a CVSS 3.1 score of 4.3 (Medium) with a network-based attack vector requiring only low complexity and low privileges (subscriber-level access). The attack requires no user interaction and impacts only the integrity of the system, not confidentiality or availability. While the CVSS rating is moderate, the vulnerability permits unauthorized manipulation of scheduling functions that could disrupt plugin operations. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and is not currently tracked on public exploit databases or hot lists. The EPSS score of 0.00035 indicates minimal probability of exploitation compared to other publicly disclosed vulnerabilities, suggesting low community attention and no readily available proof-of-concept code at this time.