Input validation vulnerability in Canto 3.0.4

The Canto plugin for WordPress is vulnerable to security issues in versions up to 3.0.4. Unauthenticated attackers can use the ‘wp_abspath’ parameter to include and execute code from a remote location, as long as allow_url_include is enabled. It is also possible to include a file from the web server’s directory, but the attacker would need to upload the malicious file first, for example using FTP.