PatchSiren cyber security CVE debrief
CVE-2023-54350 webandprint CVE debrief
CVE-2023-54350 is a HIGH severity vulnerability in the WordPress Augmented-Reality plugin. The vulnerability is caused by a remote code execution issue in the elFinder connector, which allows unauthenticated attackers to upload and execute arbitrary PHP files. Attackers can exploit this vulnerability by sending POST requests to the connector.minimal.php endpoint with mkfile and put commands to create malicious PHP files in the file_manager directory and execute them on the server. The CVSS score for this vulnerability is 8.7.
- Vendor
- webandprint
- Product
- Augmented Reality
- CVSS
- HIGH 8.7
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-08
- Original CVE updated
- 2026-06-08
- Advisory published
- 2026-06-08
- Advisory updated
- 2026-06-08
Who should care
Users of the WordPress Augmented-Reality plugin should be aware of this vulnerability and take steps to mitigate it.
Technical summary
The vulnerability is caused by a remote code execution issue in the elFinder connector, which allows unauthenticated attackers to upload and execute arbitrary PHP files.
Defensive priority
HIGH
Recommended defensive actions
- Update the WordPress Augmented-Reality plugin to the latest version.
- Restrict access to the connector.minimal.php endpoint.
- Monitor for suspicious activity on the server.
Evidence notes
The CVE record for CVE-2023-54350 was obtained from the official CVE website [cve-org]. Additional information was obtained from the NVD [nvd] and Exploit DB [ref-4].
Official resources
CVE-2023-54350 was published on 2026-06-08T02:16:22.810Z and modified on 2026-06-08T14:59:44.750Z.