CVE-2026-1306

Critical

Published: 14 February 2026

Published

14 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0446 90.2th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-1306 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

The midi-Synth plugin for WordPress is vulnerable to arbitrary file uploads in all versions through 1.1.0. The flaw stems from missing file type and extension validation in the export AJAX action, which is tracked under CWE-434 and carries a CVSS 3.1 score of 9.8.

Unauthenticated attackers can exploit the issue because a valid nonce is exposed in frontend JavaScript, allowing them to upload arbitrary files to the server and potentially achieve remote code execution.

The listed references include direct links to the vulnerable code paths in midiSynth.php and midiSynthConvert.php plus a changeset that updates the plugin, indicating an official fix has been published.

The associated EPSS score sits at 0.3145 with no material rise from a lower baseline.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-6047

Vulnerability details

The midi-Synth plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type and file extension validation in the 'export' AJAX action in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers…

to upload arbitrary files on the affected site's server which may make remote code execution possible granted the attacker can obtain a valid nonce. The nonce is exposed in frontend JavaScript making it trivially accessible to unauthenticated attackers.

CWE(s): CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

CVE-2026-1306 allows unauthenticated arbitrary file upload in a public-facing WordPress plugin, enabling exploitation of public-facing applications (T1190) and deployment of web shells for RCE (T1100).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0