WordPress AR Plugin Unauthenticated Remote Code Execution

WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that allows unauthenticated attackers to upload and execute arbitrary PHP files. Attackers can send POST requests to the connector.minimal.php endpoint with mkfile and put commands to create malicious PHP files in the file_manager directory and execute them on the server.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2023-54350 is a critical remote code execution vulnerability in the WordPress Augmented-Reality plugin's elFinder connector that allows unauthenticated attackers to upload and execute arbitrary PHP files. The vulnerability exists in the connector.minimal.php endpoint, which fails to properly validate or restrict file operations. Attackers exploit this by sending POST requests with mkfile and put commands to create malicious PHP files directly in the file_manager directory, subsequently executing them with server privileges. This affects any WordPress installation running the vulnerable plugin without authentication barriers, making it particularly dangerous for websites with default or exposed plugin directories.

Casky's 261 matched skills leverage Claude AI's extended reasoning to detect the attack patterns underlying this CVE across MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious POST requests to connector.minimal.php containing mkfile or put parameters, unusual PHP file creation in web-accessible directories, and execution patterns indicating server-side code running with web service privileges. The platform's skills would flag anomalous file upload sequences, particularly those bypassing authentication checks, and correlate them with subsequent command execution indicators—enabling security teams to detect both exploitation attempts and post-compromise PHP webshells before attackers establish persistent access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2023-54350.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2023-54350

Casky has 261 skills that investigate the attack patterns behind CVE-2023-54350. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn