CVE-2024-12066 Overview
CVE-2024-12066 affects the SMSA Shipping (official) plugin for WordPress in all versions up to and including 2.3. The plugin fails to validate file paths in the smsa_delete_label() function, allowing authenticated users with Subscriber-level access or higher to delete arbitrary files on the server. Deleting critical files such as wp-config.php can trigger the WordPress setup flow, which attackers can leverage to achieve remote code execution. The issue is tracked under [CWE-73] (External Control of File Name or Path). NVD notes that CVE-2024-49249 is likely a duplicate of this vulnerability.
Critical Impact
Authenticated Subscriber-level attackers can delete arbitrary server files, enabling remote code execution through wp-config.php deletion and site takeover.
Affected Products
- SMSA Shipping (official) WordPress plugin, versions ≤ 2.3
- WordPress sites accepting Subscriber-level registration with the plugin installed
- Any site using the vulnerable smsa_delete_label() handler prior to version 2.4
Discovery Timeline
- 2024-12-21 - CVE-2024-12066 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12066
Vulnerability Analysis
The SMSA Shipping plugin exposes a smsa_delete_label() function intended to remove shipping label files generated by the plugin. The function accepts a file path parameter from an authenticated request but does not validate or sanitize the value against an expected directory. This allows an attacker to supply a path outside the plugin's label storage directory and delete arbitrary files on the WordPress host.
Because the endpoint only requires Subscriber-level authentication, exploitation is available to any user who can register on the site. On WordPress installations with open registration, the barrier to exploitation is effectively zero. Deleting wp-config.php forces WordPress into its installation state, letting an unauthenticated attacker complete setup against an attacker-controlled database and execute arbitrary PHP through the reconfigured environment.
Root Cause
The root cause is missing path validation in smsa_delete_label(), classified as [CWE-73]. The handler passes user-controlled input directly to a file deletion call without confining the target to the plugin's own label directory or enforcing a whitelist of removable files.
Attack Vector
The attack is network-reachable and requires low privileges. An attacker authenticates as a Subscriber, sends a crafted request to the plugin's label deletion endpoint, and specifies a relative or absolute path to a sensitive file such as wp-config.php, .htaccess, or plugin files enforcing security controls. See the WordPress Plugin Code Review 2.3 for the vulnerable code path and the Wordfence Vulnerability Report for exploitation context.
No verified public proof-of-concept code is referenced by NVD. Refer to the linked vendor advisory for further technical details.
Detection Methods for CVE-2024-12066
Indicators of Compromise
- Web server access logs containing POST or AJAX requests to SMSA Shipping label deletion endpoints from low-privileged accounts
- Unexpected deletion or absence of wp-config.php, .htaccess, or plugin PHP files
- WordPress installation screen (/wp-admin/install.php) becoming reachable on a previously configured site
- New Subscriber account registrations followed shortly by file system changes under the WordPress root
Detection Strategies
- Enable WordPress file integrity monitoring to alert on deletions of core configuration files
- Inspect HTTP request bodies to the SMSA Shipping plugin handlers for path traversal sequences such as ../ or absolute paths
- Correlate authenticated Subscriber activity with file system modification events on the underlying host
Monitoring Recommendations
- Forward web server, PHP-FPM, and WordPress audit logs to a centralized analytics platform for correlation
- Alert when wp-config.php or .htaccess is deleted, renamed, or recreated outside a change window
- Track sudden spikes in Subscriber account creation on sites running the SMSA Shipping plugin
How to Mitigate CVE-2024-12066
Immediate Actions Required
- Update the SMSA Shipping (official) plugin to version 2.4 or later on every WordPress site where it is installed
- Audit wp-config.php, .htaccess, and plugin directories for unexpected deletions or modifications
- Review Subscriber and higher-privileged accounts and remove any unrecognized users created before patching
- Rotate database credentials and WordPress salts if wp-config.php was exposed or deleted
Patch Information
The vendor addressed the issue in version 2.4 of the plugin. The revised smsa_delete_label() handler is available for review in the WordPress Plugin Code Review 2.4. Site operators should apply the update through the WordPress plugin manager or WP-CLI.
Workarounds
- Deactivate and remove the SMSA Shipping plugin until version 2.4 or later can be installed
- Disable open user registration or restrict the default new-user role below Subscriber where feasible
- Place a web application firewall rule in front of the plugin's AJAX endpoints to block requests containing path traversal patterns
# Update the plugin via WP-CLI
wp plugin update smsa-shipping-official --version=2.4
# Verify installed version
wp plugin get smsa-shipping-official --field=version
# Disable open registration as a defense-in-depth measure
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
