CVE-2024-12415: AI Infographic Maker WordPress RCE Vulnerability

CVE-2024-12415 Overview

The AI Infographic Maker plugin for WordPress contains an arbitrary shortcode execution vulnerability affecting all versions up to and including 4.9.0. The flaw exists because the plugin exposes an action that invokes do_shortcode without properly validating the supplied value. Unauthenticated attackers can send crafted requests to execute arbitrary WordPress shortcodes on the target site. The issue is tracked as CWE-94: Improper Control of Generation of Code. Successful exploitation can lead to information disclosure and content manipulation depending on which shortcodes are registered on the target installation.

Critical Impact

Unauthenticated remote attackers can execute arbitrary shortcodes on affected WordPress sites, potentially exposing sensitive data or altering site content.

Affected Products

• WordPress plugin infographic-and-list-builder-ilist (AI Infographic Maker) versions up to and including 4.9.0
• WordPress sites with the plugin installed and activated
• All PHP and WordPress core versions supported by the plugin

Discovery Timeline

• 2025-01-31 - CVE-2024-12415 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12415

Vulnerability Analysis

The vulnerability resides in the plugin's embed handling logic in embed/qcld-embed-link.php. The plugin registers an action handler that accepts user-controlled input and passes it directly to WordPress's do_shortcode function. Because the handler does not authenticate the caller or restrict which shortcodes may be processed, any remote user can trigger arbitrary shortcode execution.

WordPress shortcodes execute PHP callbacks registered by core, themes, and other plugins. When an attacker controls the shortcode string, they can invoke functionality intended for administrators or trusted contexts. Depending on the shortcodes available on a target site, this can expose private post content, user data, or configuration information handled by other plugins.

The issue is classified under CWE-94: Improper Control of Generation of Code. The vendor addressed the flaw in changesets tracked in the WordPress plugin repository.

Root Cause

The root cause is missing input validation and missing capability checks around a request handler that calls do_shortcode. The plugin trusts a request parameter as safe content and forwards it into WordPress's shortcode parser without sanitization, allow-listing, or authentication controls.

Attack Vector

An unauthenticated attacker sends an HTTP request to the vulnerable endpoint exposed by the plugin, supplying a payload containing one or more WordPress shortcodes. The plugin invokes do_shortcode on the attacker-supplied string, executing the associated shortcode callbacks in the site context. No user interaction or prior privileges are required.

Technical details are documented in the WordPress Plugin Source Code and the Wordfence Vulnerability Assessment.

Detection Methods for CVE-2024-12415

Indicators of Compromise

• HTTP requests to WordPress endpoints referencing the plugin's embed action with [ and ] shortcode delimiters in query parameters or POST bodies
• Unexpected outbound requests or content changes originating from the WordPress PHP worker after inbound requests to plugin endpoints
• Web server access logs showing unauthenticated requests targeting qcld-embed-link.php or the plugin's registered AJAX action

Detection Strategies

• Inventory WordPress installations for the infographic-and-list-builder-ilist plugin and flag any version at or below 4.9.0
• Inspect web application firewall (WAF) logs for request parameters containing shortcode syntax such as [wp_ or other registered shortcode prefixes
• Correlate plugin endpoint access with subsequent anomalous database reads or file access performed by the PHP process

Monitoring Recommendations

• Enable verbose logging on WordPress AJAX and admin-ajax endpoints and forward logs to a centralized SIEM for shortcode-pattern searches
• Alert on unauthenticated POST requests to plugin-registered actions that lack a valid nonce or capability check
• Monitor for spikes in requests to the plugin's endpoints from single source IPs, which may indicate enumeration of exploitable shortcodes

How to Mitigate CVE-2024-12415

Immediate Actions Required

• Update the AI Infographic Maker plugin to a version later than 4.9.0 that includes the patched embed handler
• If an update cannot be applied immediately, deactivate and remove the plugin until the site can be patched
• Review recent access logs for requests to plugin endpoints containing shortcode syntax and audit the affected site for unauthorized content changes

Patch Information

The vendor released fixes tracked in the WordPress plugin repository. Review the applied changes in the WordPress Plugin Changeset Record and the follow-up WordPress Plugin Changeset Record. Administrators should upgrade via the WordPress plugin manager and verify that the installed version is above 4.9.0.

Workarounds

• Block unauthenticated requests to the plugin's embed endpoint at the WAF or reverse proxy layer until patching is complete
• Restrict access to wp-admin/admin-ajax.php actions registered by the plugin using server-side rules that require authentication
• Audit installed plugins and themes for shortcodes that expose sensitive data, and unregister or restrict any that are not required

# Example WordPress CLI commands to identify and update the vulnerable plugin
wp plugin list --name=infographic-and-list-builder-ilist --fields=name,status,version
wp plugin update infographic-and-list-builder-ilist
wp plugin deactivate infographic-and-list-builder-ilist   # if a patched version is not yet available