CVE-2026-1306

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The midi-Synth plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type and file extension validation in the 'export' AJAX action in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible granted the attacker can obtain a valid nonce. The nonce is exposed in frontend JavaScript making it trivially accessible to unauthenticated attackers.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Feb 14, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-130606.5An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to CVE-2026-130614.3An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stag CVE-2026-130626.5An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata CVE-2026-130636.5An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sen CVE-2026-130646.5Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB dep CVE-2026-130656.5A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sor CVE-2026-130666.5Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process m CVE-2026-130676.3When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the CVE-2026-130684.3An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a se CVE-2026-130696.5An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Enc CVE-2026-13076.5The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Information Exposure in all v CVE-2026-130705.3A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer