What is the CVSS score of CVE-2024-50510?

CVE-2024-50510 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 33.0%.

Which versions of AR For Woocommerce are affected by CVE-2024-50510?

AR For Woocommerce WordPress plugin (versions 6.3 and below) contains a critical vulnerability enabling unauthenticated attackers to execute arbitrary code on affected servers.

How to fix or mitigate CVE-2024-50510?

Within 24 hours: Identify all WordPress instances using AR For Woocommerce plugin version 6.3 or below and immediately deactivate the plugin; implement firewall rules blocking access to the /wp-content/plugins/ar-for-woocommerce/ directory. Within 7 days: Completely remove the plugin from all systems and deploy an alternative product visualization solution. Within 30 days: Audit web server logs and file systems for unauthorized file creation or web shells; verify integrity of critical WordPress directories (wp-admin, wp-includes, wp-content); if compromise indicators found, conduct forensic investigation and reset all administrative credentials.

AR For Woocommerce CVE-2024-50510

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2024-10-30 audit@patchstack.com

File Upload WordPress

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:22 NVD

10.0 (CRITICAL)

CVE Published

Oct 30, 2024 - 08:15 nvd

N/A

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For Woocommerce ar-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects AR For Woocommerce: from n/a through <= 6.3.

AnalysisAI

Unrestricted file upload in the AR For Woocommerce WordPress plugin (versions through 6.3) allows remote unauthenticated attackers to upload arbitrary files including web shells, leading to full remote code execution on the underlying web server. The vulnerability carries a maximum CVSS score of 10.0 with scope change, and an EPSS score in the 97th percentile (33.03%) indicates significantly elevated exploitation probability, though no public exploit is identified at time of analysis.

Technical ContextAI

AR For Woocommerce is a WordPress plugin developed by webandprint that adds augmented-reality product visualization functionality to WooCommerce stores. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type), where the plugin's upload handler fails to validate the type, extension, or content of uploaded files before writing them to a web-accessible location. Because WordPress executes PHP files placed within its document root, an attacker can upload a .php web shell and request it directly through the browser, achieving arbitrary command execution under the web server account (typically www-data or PHP-FPM user).

Affected ProductsAI

The vulnerability affects the AR For Woocommerce plugin for WordPress (plugin slug ar-for-woocommerce) by webandprint, in all versions from initial release through and including version 6.3. No fixed version is indicated in the available intelligence, and no CPE string was provided. The vendor advisory should be consulted via the Patchstack database entry for CVE-2024-50510, as Patchstack (audit@patchstack.com) is the reporting CNA.

RemediationAI

No vendor-released patch identified at time of analysis based on provided intelligence; administrators should monitor the Patchstack advisory and the plugin page on wordpress.org for an updated version above 6.3. Until a fixed release is available, the most effective compensating control is to deactivate and remove the AR For Woocommerce plugin entirely, accepting the loss of AR product preview functionality on the storefront. If removal is not acceptable, place a Web Application Firewall rule (Patchstack, Wordfence, or Cloudflare managed rules) blocking POST requests to the plugin's upload endpoints and any request that attempts to upload files with executable extensions (.php, .phtml, .phar, .php7) to wp-content/uploads, accepting that legitimate upload features may break. Additionally, configure the web server to deny PHP execution within wp-content/uploads via an .htaccess or nginx location block, which limits web-shell impact even if upload succeeds but may affect plugins that legitimately execute PHP from upload directories.