Auth bypass in Webandprint Augmented Reality
CVE-2023-54350
WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that allows unauthenticated attackers to upload and execute arbitrary PHP files. Attackers can send POST requests to the connector.minimal.php endpoint with mkfile and put commands to create malicious PHP files in the file_manager directory and execute them on the server.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.005 (43.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 44th percentile — 43.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Webandprint Augmented Reality — versions 7.0
Weakness classification (CWE)
References
- www.exploit-db.com/exploits/51788 (exploit)
- www.vulncheck.com/advisories/wordpress-augmented-reality-plugin-remote-code-exe… (third-party-advisory)
Frequently asked questions
- What is CVE-2023-54350?
- CVE-2023-54350 is a high-severity vulnerability in Webandprint Augmented Reality, classified under Missing Authentication for Critical Function. CVSS score: 7.5/10. Published 2026-06-08.
- How severe is CVE-2023-54350?
- High severity. CVSS v3 base score is 7.5 out of 10.