CVE-2026-1306 - Vulnerability Analysis
CriticalCVSS: 9.8Last Updated: February 14, 2026
WordPress midi-Synth - Unrestricted File Upload
Overview
WordPress midi-Synth plugin <= 1.1.0 contains an unrestricted file upload vulnerability caused by missing file type and extension validation in the 'export' AJAX action, letting unauthenticated attackers upload arbitrary files and potentially execute remote code, exploit requires attacker to obtain a valid nonce exposed in frontend JavaScript.
Severity & Score
Impact
Unauthenticated attackers can upload arbitrary files and potentially execute remote code on the server.
Mitigation
Update to the latest version of midi-Synth plugin.
References
- https://plugins.trac.wordpress.org/browser/midi-synth/tags/1.1.0/midiSynthConvert.php#L492
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d5b695d7-c690-4748-b218-5699d1aa63bf?source=cve
- https://plugins.trac.wordpress.org/browser/midi-synth/tags/1.1.0/midiSynth.php#L110
- https://plugins.trac.wordpress.org/browser/midi-synth/tags/1.1.0/midiSynth.php#L121
- https://plugins.trac.wordpress.org/browser/midi-synth/tags/1.1.0/midiSynthConvert.php#L421
Social Media Activity(6 posts)
šØ CRITICAL: CVE-2026-1306 in midi-Synth plugin for WordPress (ā¤1.1.0) enables unauthenticated file uploads ā trivial RCE risk due to exposed nonce in JS. Disable plugin or apply mitigations now. https://radar.offseq.com/threat/cve-2026-1306-cwe-434-unrestricted-upload-of-file--95798a0f #OffSeq #WordPress #Vuln #CVE20261306
View original post
š“ CVE-2026-1306 - Critical (9.8) The midi-Synth plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type and file extension validation in the 'export' AJAX action in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated ... š https://www.thehackerwire.com/vulnerability/CVE-2026-1306/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postšØ CRITICAL: CVE-2026-1306 in adminkov midi-Synth for WordPress allows unauthenticated file uploads, leading to potential RCE. All versions affected. Remove or update plugin, restrict uploads, monitor activity. https://radar.offseq.com/threat/cve-2026-1306-cwe-434-unrestricted-upload-of-file--95798a0f #OffSeq #WordPress #Vuln #CVE20261306
View original post
šØ CRITICAL: CVE-2026-1306 in midi-Synth plugin for WordPress (ā¤1.1.0) enables unauthenticated file uploads ā trivial RCE risk due to exposed nonce in JS. Disable plugin or apply mitigations now. https://radar.offseq.com/threat/cve-2026-1306-cwe-434-unrestricted-upload-of-file--95798a0f #OffSeq #WordPress #Vuln #CVE20261306
View original post
š“ CVE-2026-1306 - Critical (9.8) The midi-Synth plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type and file extension validation in the 'export' AJAX action in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated ... š https://www.thehackerwire.com/vulnerability/CVE-2026-1306/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postšØ CRITICAL: CVE-2026-1306 in adminkov midi-Synth for WordPress allows unauthenticated file uploads, leading to potential RCE. All versions affected. Remove or update plugin, restrict uploads, monitor activity. https://radar.offseq.com/threat/cve-2026-1306-cwe-434-unrestricted-upload-of-file--95798a0f #OffSeq #WordPress #Vuln #CVE20261306
View original postGitHub Repositories(1 repo)
Related Resources
Details
- CVE ID
- CVE-2026-1306
- Severity
- Critical
- CVSS Score
- 9.8
- Type
- unrestricted_file_upload
- Status
- new
- EPSS
- 13.9%
- Social Posts
- 6
CWE
- CWE-434
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H