Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-1306 — Multi-target PoC runner for CVE-2026-1306 in WordPress midi-Synth plugin: fetches nonce, sends export AJAX request to upload files, and verifies shell URLs. For authorized testing only. | Kitploit
Tools/GitHubGitHub/murrez/cve-2026-1306
Vulnerability ScannersPayload GenerationExploitationWeb Application ExploitationWeb SecurityPenetration Testing
GitHubmurrez/cve-2026-1306

CVE-2026-1306

Multi-target PoC runner for CVE-2026-1306 in WordPress midi-Synth plugin: fetches nonce, sends export AJAX request to upload files, and verifies shell URLs. For authorized testing only.

View Repository
64 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-1306 — midi-Synth (WordPress)

A Python-based, multi-target executable PoC / list runner for CVE-2026-1306 in the WordPress midi-Synth plugin.

What does it do?

  • Collects the midiSynth_nonce value via HTTP from pages where the [midiSynth] shortcode is loaded on target sites.
  • Sends an action=export request to wp-admin/admin-ajax.php; delivers the payload in the Base64 fileMidi field.
  • Relies on the possibility that, even if API key validation fails in some version behaviors, the file remains under wp-content/plugins/midi-synth/sound/.
  • Verifies shell URLs considered successful and writes them to shell.txt.

Use only in authorized environments (lab, contracted pentest, etc.).

Impact (summary)

VulnerabilityInsufficient file type / extension check in the export AJAX action (CWE-434)
Affected versions≤ 1.1.0 depending on releases; check plugin release notes for the patch
CVSS 3.19.8 Critical (NVD)

Requirements

  • Python 3.x
  • requests

Installation

root@kitploit:~
pip install requests

Usage

Create a text file listing targets line by line (lines starting with # are comments).

root@kitploit:~
python "CVE-2026-1306 midi.py" targets.txt

If the page path containing the nonce differs for your site:

root@kitploit:~
python "CVE-2026-1306 midi.py" targets.txt --paths /,/blog/midi/,/page/

By default, the script tries the following paths: /, /midi/, /midi-synth/, /synth/, /welcome/.

Output

  • Console: progress and summary
  • Successful URLs: shell.txt (append mode)
  • The sample uploaded file name is hardcoded as murrez.php in the script

Technical notes

  • TLS certificate verification is disabled (verify=False); intended for non-production testing.
  • Concurrency: 20 threads.
  • The sample file name may appear as CVE-2026-1306.py in the help output; since the file name in this repository is CVE-2026-1306 midi.py, quote the file in the command.

Defense

  • Update the plugin, or remove / disable it on the affected version.
  • If necessary, apply WAF / access restrictions to the export AJAX or related endpoints.

Disclaimer

This software is shared solely for educational and authorized security testing purposes. Unauthorized use is prohibited; responsibility for any use lies with the user.

Source

  • NVD — CVE-2026-1306
Download Tool