File Overwrite Vulnerability in SEO LAT Auto Post Plugin for WordPress
CVE-2024-12252

9.8CRITICAL

Key Information:

Vendor
Wordpress
Status
Seo Lat Auto Post
Vendor
CVE Published:
7 January 2025

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The SEO LAT Auto Post plugin for WordPress suffers from a serious file overwrite vulnerability due to the absence of necessary capability checks on the remote_update AJAX action. All versions up to and including 2.2.1 are impacted, allowing unauthenticated attackers to overwrite critical files, such as seo-beginner-auto-post.php. This exploitation can lead to remote code execution, posing significant risks to websites utilizing this plugin. It is crucial for site administrators to update their installations promptly to mitigate potential threats.

Affected Version(s)

SEO LAT Auto Post * <= 2.2.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-12252
Created by RandomRobbieBF

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/seo-beginner-auto-post/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lucio Sá
.