The AR For Woocommerce plugin by webandprint contains an unrestricted file upload vulnerability (CVE-2024-50510) that permits attackers to upload files of dangerous types, such as web shells, to the web server. This vulnerability affects all versions up to 6.3 and requires no authentication or user interaction to exploit. The CVSS 3.1 base score is 10.0, reflecting critical impact with full control over confidentiality, integrity, and availability. No patch or vendor advisory details are currently available, and the vulnerability was publicly disclosed on 2024-10-30.

Successful exploitation allows remote attackers to upload and execute arbitrary code on the affected web server, leading to full system compromise including data theft, modification, or deletion, and potential disruption of service. The vulnerability requires no privileges or user interaction, making it highly exploitable over the network. The critical CVSS score reflects the severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict file upload permissions, implement web application firewall rules to block malicious uploads, and monitor for suspicious activity related to file uploads. Avoid exposing the vulnerable plugin to untrusted users or public networks if possible.