What the vulnerability does
01Description
The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3. This makes it possible for unauthenticated attackers to upload php files leveraging a double extension attack. It's important to note the file is deleted immediately and double extension attacks only work on select servers making this unlikely to be successfully exploited.
Explanation of Vulnerability in Simple Terms
02Summary
The AR for WordPress plugin through version 7.3 lacks proper authorization checks on certain functions. An attacker without authentication can modify data on the site, though the attack requires specific conditions to succeed. The vulnerability has low integrity impact and does not affect confidentiality or availability.
What an attacker can do
03Attacker Capabilities
Modify site data without authentication, subject to specific attack conditions.
Potential impact on your site
04Site Impact
Unauthorized changes to site content or settings if the specific attack conditions are met.
Conditions required to exploit
05Prerequisites
Network access to the WordPress site; no authentication required, but attack complexity is high.
Key dates
06Disclosure timeline
December 13, 2024
CVE published
April 8, 2026
Record updated
