Back to Database
Status published
Critical
CVE-2025-60156
WordPress AR For WordPress plugin <= 8.34 - Cross Site Request Forgery (CSRF) vulnerability
Vulnerability Description
Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 8.34.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-60156
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Abu Hurayra | Patchstack Bug Bounty Program
More from webandprint
View All →CVE-2025-26913
WordPress AR for WordPress plugin <= 7.7 - Cross Site Scripting (XSS) vulnerability
Medium
6.5
CVE-2024-50510
WordPress AR For Woocommerce plugin <= 6.3 - Arbitrary File Upload vulnerability
Critical
10
CVE-2024-50496
WordPress AR For WordPress plugin <= 6.6 - Arbitrary File Upload vulnerability
Critical
10
CVE-2024-12300
AR for WordPress <= 7.3 - Missing Authorization to Unauthenticated Limited File Upload
Low
3.7
CVE-2023-54350
WordPress Augmented-Reality Plugin Remote Code Execution Unauthenticated
High
8.7
Affected Vendor
webandprint
View all reports →Affected Software
AR For WordPress
Vulnerable Versions:
0
Timeline
Official Publish:
September 26th, 2025
Last Modified:
April 28th, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H