CVE-2024-12269: Safe AI Malware Protection WP Disclosure

CVE-2024-12269 Overview

CVE-2024-12269 is a missing authorization vulnerability [CWE-862] in the Safe AI Malware Protection for WP plugin for WordPress. The flaw exists in the export_db() function, which lacks a capability check across all versions up to and including 1.0.17. Unauthenticated attackers can invoke the function over the network to retrieve a complete dump of the site's database. The vendor is wpmessiah, and the affected component is safe-ai-malware-protection-for-wp.

Critical Impact

Unauthenticated remote attackers can export the entire WordPress database, exposing user credentials, session tokens, personal data, and site secrets stored in wp_options.

Affected Products

• Wpmessiah Safe AI Malware Protection for WP — all versions through 1.0.17
• WordPress installations with the plugin active
• Sites exposing the plugin's AJAX or admin-post endpoints to unauthenticated traffic

Discovery Timeline

• 2025-01-30 - CVE-2024-12269 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2024-12269

Vulnerability Analysis

The vulnerability is a Missing Authorization flaw in the plugin's database export functionality. The export_db() function in includes/class-mvsp-export-db.php is registered as a callable handler but does not verify the caller's WordPress capability or nonce. As a result, any HTTP client can invoke the export endpoint without authenticating.

When invoked, the function generates a full SQL dump of the WordPress database and returns it to the requester. This exposes the wp_users table, including hashed passwords and email addresses, along with session tokens, API keys, and any sensitive data stored by other plugins. An attacker who obtains the dump can perform offline password cracking, hijack administrative sessions, or pivot to other systems sharing reused credentials.

Root Cause

The root cause is the absence of a current_user_can() capability check and a missing check_ajax_referer() nonce validation inside the export handler. WordPress requires plugins to gate privileged actions behind capability checks such as manage_options or export, but the affected handler executes the export logic unconditionally upon receiving a request.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends a crafted HTTP request to the plugin's registered export endpoint and receives the SQL dump in the response body. No authentication, user interaction, or special privileges are required. The vulnerability impacts confidentiality only; the database is read but not modified.

See the Wordfence Vulnerability Report and the WordPress Plugin Source Code for technical details on the unprotected handler.

Detection Methods for CVE-2024-12269

Indicators of Compromise

• Unauthenticated HTTP requests targeting plugin paths containing mvsp-export-db or export_db actions in admin-ajax.php or admin-post.php query strings.
• Large outbound HTTP responses from /wp-admin/admin-ajax.php to unauthenticated clients containing SQL syntax such as INSERT INTO wp_users.
• Access log entries from unknown IP addresses requesting plugin endpoints with no preceding wp-login.php authentication.

Detection Strategies

• Inspect web server access logs for requests referencing the Safe AI Malware Protection plugin's export action originating from unauthenticated sessions.
• Deploy a Web Application Firewall (WAF) rule that blocks calls to the plugin's export handler unless the request carries a valid administrative session cookie.
• Monitor for anomalous response sizes from admin-ajax.php that exceed typical AJAX payload thresholds, indicating bulk data exfiltration.

Monitoring Recommendations

• Alert on any HTTP response from WordPress endpoints containing SQL dump signatures such as CREATE TABLE, INSERT INTO wp_, or DROP TABLE IF EXISTS.
• Track requests per second against the plugin's endpoints and flag bursts from a single source IP.
• Audit the WordPress plugin inventory regularly to identify installations of safe-ai-malware-protection-for-wp at version 1.0.17 or earlier.

How to Mitigate CVE-2024-12269

Immediate Actions Required

• Update the Safe AI Malware Protection for WP plugin to a version newer than 1.0.17, if a patched release is available from the vendor.
• If no patched version is available, deactivate and uninstall the plugin until a fix is published.
• Rotate all WordPress user passwords, API keys, and secrets stored in wp_options if exploitation is suspected.

Patch Information

Review the WordPress Plugin Changeset for the upstream code change addressing the missing capability check. Confirm the installed version against the vendor's plugin repository entry before relying on the fix.

Workarounds

• Block access to the plugin's export endpoint at the WAF or reverse proxy layer by denying unauthenticated requests that match the export action parameter.
• Restrict access to /wp-admin/admin-ajax.php and /wp-admin/admin-post.php to authenticated sessions via IP allowlisting where feasible.
• Apply a custom must-use plugin that wraps the vulnerable handler with a current_user_can('manage_options') check until the official patch is applied.

# Example nginx rule to block unauthenticated calls to the vulnerable action
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "mvsp_export_db|export_db") {
        return 403;
    }
}