What is the CVSS score of CVE-2024-50496?

CVE-2024-50496 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.3%.

Which versions of AR For WordPress are affected by CVE-2024-50496?

The AR For WordPress plugin (versions ≤6.6) contains a critical vulnerability allowing unauthenticated attackers to upload malicious files directly to affected websites, resulting in complete server…

How to fix or mitigate CVE-2024-50496?

24 hours: Deactivate and uninstall the AR For WordPress plugin on all affected instances; audit web server logs and filesystem for suspicious uploads, executable files, or web shells created in the past 90 days; assess whether compromise has occurred. 7 days: Implement file upload restrictions at WAF or server level blocking .php, .phtml, .exe, and other executable extensions; deploy file integrity monitoring on web root directories; evaluate alternative plugins with active vendor security support. 30 days: Migrate to patched version of AR For WordPress once released by vendor, or permanently replace plugin if vendor does not release a fix within 30 days.

AR For WordPress CVE-2024-50496

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2024-10-28 audit@patchstack.com

File Upload WordPress

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Oct 28, 2024 - 21:15 nvd

CRITICAL 10.0

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 6.6.

AnalysisAI

Unauthenticated arbitrary file upload in the AR For WordPress plugin (versions up to and including 6.6) allows remote attackers to upload web shells and achieve full site compromise. With a maximum CVSS score of 10.0 and CWE-434 (Unrestricted Upload of File with Dangerous Type), the flaw is critical, though no public exploit identified at time of analysis and EPSS sits at 1.31% (80th percentile) indicating moderate predicted exploitation activity. Reported via Patchstack, the issue affects all known versions of the plugin from webandprint.

Technical ContextAI

AR For WordPress (ar-for-wordpress) is a third-party WordPress plugin from vendor webandprint that adds augmented reality capabilities to WordPress sites. The CPE string cpe:2.3:a:webandprint:ar:*:*:*:*:*:wordpress:*:* confirms the affected component is the plugin itself running within the WordPress application stack. CWE-434 (Unrestricted Upload of File with Dangerous Type) indicates the plugin's file upload handler fails to validate uploaded file extensions, MIME types, or content, permitting executable PHP files to be written to a web-accessible directory where the WordPress PHP runtime will execute them on request.

RemediationAI

No vendor-released patch identified at time of analysis - the description bounds affected versions at <= 6.6 with no fixed version stated, so administrators should monitor Patchstack and the webandprint plugin changelog for a patched release above 6.6 and apply it as soon as one is published. Until a fix is available, the most reliable compensating control is to deactivate and remove the AR For WordPress plugin entirely from production sites, which eliminates the upload endpoint at the cost of losing AR functionality; alternatively, place a WAF rule or .htaccess restriction in front of the plugin's upload directory to block requests to .php (and other executable) files within wp-content/plugins/ar-for-wordpress/, accepting that this is bypass-prone if the plugin writes uploads elsewhere. Restricting access to wp-admin and the plugin's AJAX/REST endpoints by IP allowlist is another stopgap but only helps where administrative access is geographically constrained.