Executive brief
The Augmented Reality plugin for WordPress, which allows site owners to display 3D models, contains a critical security flaw. An unauthenticated attacker can remotely upload and run malicious code on the website's server. This could lead to a complete takeover of the website, theft of customer data, or the site being used to host further attacks.
Technical details
The WordPress Augmented-Reality plugin (version 7.0 and below) is vulnerable to unauthenticated remote code execution due to a lack of authentication in its integrated elFinder connector. The vulnerability resides in the 'connector.minimal.php' endpoint, which fails to restrict access to critical file management functions. An attacker can send specially crafted POST requests using the 'mkfile' and 'put' commands to create and populate arbitrary PHP files within the 'file_manager' directory. Once uploaded, these files can be accessed via a direct URL to execute arbitrary code with the privileges of the web server. Public exploit code is available.
Affected products
- WordPress Augmented Reality <= 7.0
Timeline
- 2023-09-20: other: Vulnerability discovered by researcher
- 2024-02-09: disclosed: Exploit published on Exploit-DB
- 2026-06-08: advisory: NVD and VulnCheck advisory published