CVE-2024-12300

The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3. This makes it possible for unauthenticated attackers to upload php files leveraging a double extension attack. It's important to note the file is deleted immediately and double extension attacks only work on select servers making this unlikely to be successfully exploited.

• CWE-862

• https://plugins.trac.wordpress.org/browser/ar-for-wordpress/trunk/includes/ar-add-media.php?rev=3177638
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3206666%40ar-for-wordpress%2Ftrunk&old=3205240%40ar-for-wordpress%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8b507369-49f7-4a1d-900b-c7bef40aec96?source=cve

Published

Dec 13, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12295The BoomBox Theme Extensions plugin for WordPress is vulnera…8.8
• CVE-2024-12296The Apus Framework plugin for WordPress is vulnerable to una…8.8
• CVE-2024-12297Moxa’s Ethernet switch is vulnerable to an authentication by…9.2
• CVE-2024-12298We found a vulnerability Improper Restriction of XML Externa…5.5
• CVE-2024-12299The System Dashboard plugin for WordPress is vulnerable to R…6.1
• CVE-2024-1230The SimpleShop plugin for WordPress is vulnerable to Cross-S…4.3
• CVE-2024-12301The JSP Store Locator WordPress plugin through 1.0 does not …6.5
• CVE-2024-12302The Icegram Engage WordPress plugin before 3.1.32 does not …6.1
• CVE-2024-12303An issue has been discovered in GitLab CE/EE affecting all v…5.5
• CVE-2024-12304The Gutenberg Blocks with AI by Kadence WP – Page Builder Fe…5.4
• CVE-2024-12305An object-level access control vulnerability in Unifiedtrans…4.3
• CVE-2024-12306Multiple access control vulnerabilities in Unifiedtransform …4.3