CVE-2020-28977: The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability.

Security readout for executives and security teams

CVE-2020-28977 is a blind server-side request forgery issue in the Canto WordPress plugin 1.3.0. An unauthenticated internet user could cause the WordPress server to make requests to internal or external systems. This can matter if the web server can reach private services, cloud metadata, or sensitive management interfaces. Exposure is likely limited to WordPress sites running Canto plugin version 1.3.0 with the vulnerable plugin route reachable from the internet. Risk increases when the WordPress host has network access to internal services, cloud metadata endpoints, or trusted-only APIs. Prioritize internet-facing WordPress sites using Canto 1.3.0, especially in cloud or segmented internal environments. The issue is unauthenticated and public, but active exploitation is not confirmed in the provided sources. Mitigation focus: Inventory WordPress sites for the Canto plugin and identify version 1.3.0 installs.; Disable or remove the plugin where it is not business-critical.; Check Canto and WordPress plugin guidance for a fixed version or official mitigation..

Prepared

Jun 5, 2026, 13:31 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.