CVE-2026-52703: WordPress FastDup plugin <= 2.7.2 - Path Traversal vulnerability

Synopsis

A path traversal vulnerability in the FastDup WordPress plugin (versions 2.7.2 and earlier) allows an unauthenticated remote attacker to read and write files outside the intended directory on the web server. The vulnerability is reachable over the network, requires no login, but does require a victim to interact (for example, by visiting a crafted link or page). Successful exploitation gives the attacker full read access to sensitive files, the ability to modify or overwrite server-side content, and the means to crash or destabilize the affected service. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress service over the network; no local or physical access is needed.

• AuthenticationNot required

  No account or credential of any privilege level is needed to trigger the path traversal.

• Victim interactionRequired

  A victim (such as a logged-in site user or administrator) must perform an action, for example visiting a crafted URL or page, for the exploit to complete.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout dependencies, or special environmental factors need to align.

Blast Radius

• Reads arbitrary files on the server, including WordPress configuration files that contain database credentials and secret keys.
• Modifies or overwrites server-side files, enabling injection of malicious code into theme files, plugins, or core WordPress files.
• Crashes or destabilizes the web service by corrupting files the application depends on at runtime.
• Because the scope is changed (S:C in the CVSS vector), impact can extend beyond the WordPress application itself to other services or data on the same host.