CVE-2025-60156

WordPress AR For WordPress plugin <= 8.34 - Cross Site Request Forgery (CSRF) vulnerability

View on CVE.org
Published Sep 26, 2025 CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Description
Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 8.34.

Analysis

AI-generated

Technical impact

A Cross‑Site Request Forgery vulnerability in the AR For WordPress plugin allows an attacker to upload a web shell to the web server, effectively providing remote code execution capability. The weakness is identified as CWE‑352 and is present in all releases of the plugin up to version 8.34.

Affected Systems

The vulnerability affects the webandprint AR For WordPress plugin for WordPress sites. All installed versions from the earliest releases through 8.34 are vulnerable, regardless of WordPress version.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.6, indicating a high severity level. The EPSS score of less than 1 % suggests the likelihood of exploitation is currently low, but the attack risks are severe. The CMS is not listed in the CISA KEV catalog. The likely attack path involves a user authenticated to the WordPress dashboard being tricked into loading a crafted request that triggers the upload function, which then stores a malicious file on the server. Successful exploitation would enable an attacker to execute arbitrary code on the host.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade AR For WordPress to a version newer than 8.34 or apply the vendor‑supplied patch that removes the upload capability for arbitrary files.
  • If an upgrade is not immediately possible, restrict the upload feature to users with administrative privileges or disable it entirely for lower‑privileged roles.
  • Add or verify CSRF token validation on the upload endpoint; if the plugin does not already implement this, apply a nonce check or use a security plugin to enforce CSRF protection.

Generated by OpenCVE AI on April 30, 2026 at 05:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-31249 Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress allows Upload a Web Shell to a Web Server. This issue affects AR For WordPress: from n/a through 7.98.
History
Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 8.36. Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 8.34.
Title WordPress AR For WordPress plugin <= 8.36 - Cross Site Request Forgery (CSRF) vulnerability WordPress AR For WordPress plugin <= 8.34 - Cross Site Request Forgery (CSRF) vulnerability
Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 8.34. Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 8.36.
Title WordPress AR For WordPress plugin <= 8.34 - Cross Site Request Forgery (CSRF) vulnerability WordPress AR For WordPress plugin <= 8.36 - Cross Site Request Forgery (CSRF) vulnerability
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}
Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress allows Upload a Web Shell to a Web Server. This issue affects AR For WordPress: from n/a through 7.98. Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 8.34.
Title WordPress AR For WordPress Plugin <= 7.98 - Cross Site Request Forgery (CSRF) Vulnerability WordPress AR For WordPress plugin <= 8.34 - Cross Site Request Forgery (CSRF) vulnerability
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}
Type Values Removed Values Added
First Time appeared Webandprintdesign
Webandprintdesign ar For Wordpress
Wordpress
Wordpress wordpress
Vendors & Products Webandprintdesign
Webandprintdesign ar For Wordpress
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress allows Upload a Web Shell to a Web Server. This issue affects AR For WordPress: from n/a through 7.98.
Title WordPress AR For WordPress Plugin <= 7.98 - Cross Site Request Forgery (CSRF) Vulnerability
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}
Earlier changes (1)
Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:13 PM
Reserved
Sep 25, 2025, 3:28 PM

View source JSON

Updated
Sep 26, 2025, 2:11 PM

JSON

Status
Deferred
Published
Sep 26, 2025, 9:15 AM
Modified
Oct 11, 2026, 8:10 PM

View source JSON

No data.

Updated
Apr 30, 2026, 6:00 AM

JSON