CVE-2026-52703 CRITICAL

CVE-2026-52703: WordPress FastDup plugin <= 2.7.2 - Path Traversal vulnerability

Vendor Ninja Team
Product FastDup
Weakness CWE-35
Published June 15, 2026
Last update June 16, 2026
View on NVD All CVEs

CVSS base score

9.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.

Explanation of Vulnerability in Simple Terms

02Summary

FastDup versions up to 2.7.2 contain a vulnerability that allows an attacker to read sensitive data, modify site content, or disrupt service. The attack requires user interaction—typically clicking a malicious link—but no authentication. The impact extends beyond the vulnerable component itself. Update to version 2.7.3 or later.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify site content, or disrupt service by tricking a user into clicking a malicious link.

Potential impact on your site

04Site Impact

Site visitors could be compromised, data stolen, or the site taken offline without warning.

Conditions required to exploit

05Prerequisites

User must click a malicious link or visit an attacker-controlled page; no login required.

Key dates

06Disclosure timeline

June 15, 2026 CVE published
June 16, 2026 Record updated