CVE-2023-54350 - CVE House

Back to Database

Status published High CVE-2023-54350

WordPress Augmented-Reality Plugin Remote Code Execution Unauthenticated

8.7 CVSS

Vulnerability Description

WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that allows unauthenticated attackers to upload and execute arbitrary PHP files. Attackers can send POST requests to the connector.minimal.php endpoint with mkfile and put commands to create malicious PHP files in the file_manager directory and execute them on the server.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-54350

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Milad Karimi (Ex3ptionaL)

References

More from webandprint

View All →

WordPress AR For WordPress plugin <= 8.34 - Cross Site Request Forgery (CSRF) vulnerability

WordPress AR for WordPress plugin <= 7.7 - Cross Site Scripting (XSS) vulnerability

WordPress AR For Woocommerce plugin <= 6.3 - Arbitrary File Upload vulnerability

WordPress AR For WordPress plugin <= 6.6 - Arbitrary File Upload vulnerability

AR for WordPress <= 7.3 - Missing Authorization to Unauthenticated Limited File Upload

Affected Vendor

webandprint

View all reports →

Affected Software

Augmented Reality

Vulnerable Versions:

7.0

Timeline

Official Publish: June 8th, 2026

Last Modified: June 9th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1136 Create Account

T1098 Account Manipulation

Privilege Escalation

T1021 Remote Services

Lateral Movement