What the vulnerability does
01Description
The midi-Synth plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type and file extension validation in the 'export' AJAX action in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible granted the attacker can obtain a valid nonce. The nonce is exposed in frontend JavaScript making it trivially accessible to unauthenticated attackers.
Explanation of Vulnerability in Simple Terms
02Summary
midi-Synth versions 1.1.0 and earlier allow unauthenticated attackers to upload arbitrary files to the server without restriction. An attacker can upload malicious files—including executable code—over the network with no authentication or user interaction required. This can lead to complete compromise of the site, including data theft, site defacement, and malware installation.
What an attacker can do
03Attacker Capabilities
Upload arbitrary files to the server and execute malicious code without authentication.
Potential impact on your site
04Site Impact
Complete compromise of the site: attackers can steal data, deface content, install malware, or take full control.
Conditions required to exploit
05Prerequisites
Network access to the vulnerable midi-Synth installation; no authentication or user interaction required.
Key dates
06Disclosure timeline
February 14, 2026
CVE published
April 8, 2026
Record updated
