CVE-2023-54350: WordPress Augmented-Reality Plugin Remote Code Execution

Technical summary

CVE-2023-54350 is a remote code execution vulnerability in the WordPress Augmented-Reality plugin's elFinder connector. The vulnerability stems from insufficient authentication controls on the connector.minimal.php endpoint (CWE-306: Missing Authentication for Critical Function). Attackers can send unauthenticated POST requests using mkfile and put commands to write arbitrary PHP files into the file_manager directory, then trigger execution of those files on the web server. The attack requires no user interaction, no special privileges, and works over the network, resulting in a CVSS 3.1 score of 7.5 (HIGH severity with confidentiality impact).

Business impact

Successful exploitation grants an attacker arbitrary code execution on the web server hosting the WordPress installation. This permits data theft from the database, modification or deletion of site content, installation of backdoors for persistence, lateral movement into internal networks, and potential use of the compromised server as a staging ground for attacks on other systems. For organizations relying on WordPress for customer-facing applications or sensitive operations, this vulnerability represents an immediate path to full compromise.

Affected systems

WordPress installations with the Augmented-Reality plugin installed are affected. The vulnerability is unauthenticated and network-reachable, meaning any WordPress site with this plugin active is vulnerable by default unless network-level access controls restrict traffic to the vulnerable endpoint. Organizations should inventory their WordPress instances to identify those using this plugin and its current version.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, no special configuration, and can be triggered with basic HTTP POST requests. The attack is straightforward: an attacker sends a crafted request to a known endpoint (connector.minimal.php) with file creation and execution commands. Public documentation or basic reverse-engineering of the elFinder connector could enable rapid weaponization. The lack of any authentication barrier makes this a critical priority for immediate remediation.

Remediation

The primary remediation is to update the WordPress Augmented-Reality plugin to a patched version that fixes the authentication bypass in the elFinder connector. Until a patch is available or deployable, disable or remove the Augmented-Reality plugin entirely. If the plugin is essential, restrict network access to the connector.minimal.php endpoint using a Web Application Firewall (WAF) or network ACLs to allow only authorized users or IP ranges. Additionally, implement general WordPress hardening: disable file editing, restrict plugin/theme uploads, and monitor the file_manager directory for unauthorized PHP files.

Patch guidance

Check the WordPress plugin repository and the plugin vendor's advisory for the specific patched version number that addresses CVE-2023-54350. Apply the patch immediately once available and verified. Verify the plugin update through the WordPress admin dashboard or via wp-cli. After patching, confirm that the file_manager directory has not been modified by an attacker and that no unauthorized PHP files exist in that location.

Detection guidance

Search web server access logs for POST requests to any endpoint containing 'connector.minimal.php' or similar elFinder connector paths. Look for requests with mkfile or put commands in the query string or POST body. Monitor the file_manager directory for unexpected PHP files created around the time of the vulnerability disclosure or after. Use web application firewalls to flag or block POST requests to connector.minimal.php from unauthenticated sources. File integrity monitoring (FIM) on the file_manager and WordPress root directories will alert if new PHP files are created.

Why prioritize this

This vulnerability scores 7.5 (HIGH) with a network attack vector, no authentication requirement, and direct confidentiality impact. The elFinder connector's public-facing nature and the simplicity of exploitation make this a top-tier priority. WordPress Augmented-Reality plugin users should treat this as critical and patch or disable immediately.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: (1) Network Accessibility (AV:N)—the endpoint is reachable remotely; (2) Low Attack Complexity (AC:L)—no special conditions or user interaction needed; (3) No Privileges Required (PR:N)—unauthenticated attackers can exploit it; (4) No User Interaction (UI:N)—the attack is fully automated; (5) High Confidentiality Impact (C:H)—successful exploitation allows reading sensitive data. The absence of integrity and availability impacts in the vector reflects the focus on unauthorized access rather than data modification or denial of service, but in practice, full RCE enables all three impact types.

Frequently asked questions