What is CVE-2023-54350?

CVE-2023-54350 is a high-severity vulnerability in Webandprint Augmented Reality, classified under Missing Authentication for Critical Function. CVSS score: 7.5/10. Published 2026-06-08.

How severe is CVE-2023-54350?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Webandprint Augmented Reality

CVE-2023-54350

WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that allows unauthenticated attackers to upload and execute arbitrary PHP files. Attackers can send POST requests to the connector.minimal.php endpoint with mkfile and put commands to create malicious PHP files in the file_manager directory and execute them on the server.

Vulnerability class: Broken Authentication

EPSS: 0.005 (42.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Webandprint Augmented Reality — versions 7.0

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2023-54350?: CVE-2023-54350 is a high-severity vulnerability in Webandprint Augmented Reality, classified under Missing Authentication for Critical Function. CVSS score: 7.5/10. Published 2026-06-08.
How severe is CVE-2023-54350?: High severity. CVSS v3 base score is 7.5 out of 10.