CVE-2024-12300: 
WordPress vulnerability analysis and mitigation

The AR for WordPress plugin is affected by CVE-2024-12300, a vulnerability discovered and disclosed on December 12, 2024. The vulnerability affects all versions up to and including 7.3 of the plugin. This security issue stems from a missing capability check in the setarfeatured_image() function, which could potentially allow unauthorized file uploads (NVD CVE).

The vulnerability is classified as a Missing Authorization issue (CWE-862) that enables unauthorized double extension file upload attacks. The CVSS v3.1 base score is 3.7 (Low) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating a network-accessible vulnerability with high attack complexity, requiring no privileges or user interaction (NVD CVE).

The vulnerability allows unauthenticated attackers to upload PHP files through a double extension attack. However, the impact is limited as the uploaded file is deleted immediately, and double extension attacks are only effective on select servers, making successful exploitation unlikely (NVD CVE).

Users should update their AR for WordPress plugin to a version newer than 7.3 to address this vulnerability. The issue has been patched in subsequent releases (NVD CVE).