CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 6.6.
Explanation of Vulnerability in Simple Terms
The AR For WordPress plugin versions 6.6 and earlier contain an unrestricted file upload vulnerability. An attacker can upload arbitrary files to the site without authentication, potentially allowing them to run malicious code, modify site content, or take full control of the WordPress installation. This is a critical vulnerability affecting all installations of the plugin.
What an attacker can do
Upload arbitrary files and run malicious code on the site without needing to log in.
Potential impact on your site
Complete compromise of the WordPress site, including data theft, malware injection, and loss of site control.
Conditions required to exploit
None. The attacker can exploit this remotely over the network without authentication or user interaction.
Key dates
External resources
Related vulnerabilities
