CVE-2024-12300 is a missing authorization vulnerability (CWE-862) in the AR for WordPress plugin. The set_ar_featured_image() function lacks a capability check, enabling unauthenticated attackers to upload files with double extensions. Although this could allow PHP file uploads, the plugin deletes such files immediately, and successful exploitation depends on specific server configurations. This vulnerability affects all versions up to 7.3 and has a CVSS 3.1 score of 3.7 (low severity). No known exploits are reported in the wild, and no patch or official fix has been documented yet.

The vulnerability could allow unauthorized file uploads with double extensions, potentially leading to limited impact such as low integrity compromise. However, immediate deletion of the uploaded files and the requirement for specific server configurations significantly reduce the risk and likelihood of successful exploitation. There is no confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. Given the low likelihood of exploitation and immediate file deletion, no urgent mitigation is mandated by the vendor at this time.