{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-14T21:38:17.587","vulnerabilities":[{"cve":{"id":"CVE-2024-12300","sourceIdentifier":"security@wordfence.com","published":"2024-12-13T04:15:05.073","lastModified":"2026-04-15T00:35:42.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3. This makes it possible for unauthenticated attackers to upload php files leveraging a double extension attack. It's important to note the file is deleted immediately and double extension attacks only work on select servers making this unlikely to be successfully exploited."},{"lang":"es","value":"El complemento AR para WordPress es vulnerable a la carga no autorizada de archivos de doble extensión debido a una verificación de capacidad faltante en la función set_ar_featured_image() en todas las versiones hasta la 7.3 incluida. Esto hace posible que atacantes no autenticados carguen archivos php aprovechando un ataque de doble extensión. Es importante tener en cuenta que el archivo se elimina inmediatamente y que los ataques de doble extensión solo funcionan en servidores seleccionados, por lo que es poco probable que esto se explote con éxito."}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ar-for-wordpress/trunk/includes/ar-add-media.php?rev=3177638","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3206666%40ar-for-wordpress%2Ftrunk&old=3205240%40ar-for-wordpress%2Ftrunk&sfp_email=&sfph_mail=","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b507369-49f7-4a1d-900b-c7bef40aec96?source=cve","source":"security@wordfence.com"}]}}]}