Security Alert Summary
The WordPress Augmented-Reality plugin contains a remote code execution vulnerability in its elFinder connector that allows unauthenticated attackers to upload and execute arbitrary PHP files. Attackers can send specially crafted POST requests to the connector.minimal.php endpoint using the mkfile and put commands to create and run PHP files in the file_manager directory.
CVE Details
- CVE ID: CVE-2023-54350
- Affected component: WordPress Augmented-Reality plugin (elFinder connector)
- Affected versions: Not specified in the provided data
- Published: June 8, 2026 at 2:16:22 AM UTC
- Last modified: June 8, 2026 at 2:59:44 PM UTC
- CVSS v3.1 base score: 7.5 (HIGH)
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Authentication requirements: None
- Privileges required: None
- User interaction: None
- Primary impact: Confidentiality – HIGH; Integrity – NONE; Availability – NONE
- Weakness (CWE): CWE-306
Technical Details
The vulnerability exists in the plugin’s elFinder connector. According to the provided description, unauthenticated attackers can send POST requests to the connector.minimal.php endpoint using the mkfile and put commands. These requests can create PHP files inside the plugin’s file_manager directory and then execute them on the server, resulting in remote code execution.
This issue exists because the connector accepts file-creation and file-write operations without sufficient access control or validation for PHP uploads, allowing arbitrary PHP code to be placed and run on the host. The reported impact is the ability to upload and execute arbitrary PHP files; the CVSS data indicates a primary confidentiality impact.
How This Could Impact Your Website
In a realistic scenario, a site owner manages the WordPress installation while internal staff (editors or content managers) and external contractors or contributors have varying user roles. An unauthenticated attacker exploiting this vulnerability could upload PHP files that read site data or configuration files. That could lead to exposure of internal user email addresses and other sensitive data stored on the server. With email addresses exposed, attackers can perform targeted phishing or social engineering against staff, contractors, or site users.
The vulnerability does not require a logged-in user or user interaction to trigger, which increases the potential attack surface for sites using the affected connector. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level or other roles that can upload or manage files.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and connectors that are not required for site functionality.
- Monitor site activity and server logs for unusual file uploads, requests to
connector.minimal.php, or execution of unexpected PHP files.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
