CVE-2024-12471: Post Saint WordPress Plugin RCE Flaw

CVE-2024-12471 Overview

CVE-2024-12471 is an arbitrary file upload vulnerability in the Post Saint WordPress plugin. The plugin bundles integrations for ChatGPT, GPT-4, DALL-E, Stable Diffusion, Pexels, and Dezgo AI text and image generation. The flaw affects all versions up to and including 1.3.1.

The add_image_to_library AJAX action function is missing both a capability check and file type validation. Authenticated users with subscriber-level access or above can upload arbitrary files to the WordPress installation. Successful exploitation enables remote code execution on the underlying web server. The issue is tracked under [CWE-94] (Improper Control of Generation of Code).

Critical Impact
A subscriber-level account can upload executable PHP files and achieve remote code execution on the WordPress host.

Affected Products

Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator plugin for WordPress
All plugin versions up to and including 1.3.1
WordPress sites permitting subscriber-level registrations with the plugin active

Discovery Timeline

2025-01-07 - CVE-2024-12471 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12471

Vulnerability Analysis

The Post Saint plugin exposes an AJAX endpoint bound to the add_image_to_library action. This handler is intended to add generated or fetched images into the WordPress media library. The handler fails to verify the caller's WordPress capability and does not validate the type or extension of the uploaded file.

Because the AJAX endpoint is registered via wp_ajax_ without a matching capability check, any authenticated user reaching the endpoint can invoke it. The scope of allowed callers therefore includes low-privilege roles such as subscriber. Combined with missing file type validation, this allows attackers to write PHP files inside the WordPress uploads directory.

The uploaded PHP payload can then be requested directly over HTTP, executing attacker-controlled code under the web server user. This yields full compromise of the WordPress site and often the underlying host.

Root Cause

The root cause is a combination of two defects in the add_image_to_library AJAX handler. First, the function omits a current_user_can() check appropriate for a media upload operation, such as upload_files. Second, the function accepts a client-supplied file without validating the MIME type or extension against a WordPress-safe allowlist.

Attack Vector

An attacker registers or acquires a subscriber account on a target WordPress site running Post Saint <= 1.3.1. The attacker authenticates and issues a POST request to /wp-admin/admin-ajax.php with action=add_image_to_library and a crafted file parameter containing PHP source. The plugin writes the file into an uploads path. The attacker then requests the uploaded file to trigger code execution. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-12471

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with the parameter action=add_image_to_library originating from low-privilege accounts
New files with executable extensions (.php, .phtml, .phar) inside wp-content/uploads/ created after plugin installation
Recently created WordPress subscriber accounts that immediately interact with admin-ajax.php
Outbound connections from the web server process to unfamiliar hosts following upload activity

Detection Strategies

Inspect web server access logs for add_image_to_library AJAX calls correlated with non-administrator session cookies
Run file integrity monitoring on wp-content/uploads/ and alert on non-image file types
Baseline the WordPress user table and alert on new subscribers followed by admin-ajax activity within a short window

Monitoring Recommendations

Forward WordPress access logs and PHP error logs to a central SIEM for correlation across auth and file-write events
Alert on php process execution spawned from the web server user with unusual child processes such as sh, curl, or wget
Monitor for new listening sockets or reverse-shell patterns on hosts running the affected plugin

How to Mitigate CVE-2024-12471

Immediate Actions Required

Update the Post Saint plugin to a version later than 1.3.1 as soon as a fixed release is available from the vendor
Disable and remove the Post Saint plugin if no patched version is installed
Audit wp-content/uploads/ for unexpected PHP or executable files and remove them
Rotate WordPress administrator credentials and review recently created user accounts

Patch Information

Refer to the Post Saint plugin page on WordPress.org for the latest version and changelog. Confirm the plugin version in use is greater than 1.3.1 before restoring the plugin to production. Additional advisory details are available in the Wordfence Vulnerability Report.

Workarounds

Disable open user registration or restrict the default role away from subscriber while a fix is unavailable
Block execution of PHP within wp-content/uploads/ at the web server level using directives that deny .php handling in that path
Place a Web Application Firewall rule that blocks requests to admin-ajax.php with action=add_image_to_library originating from non-administrative sessions

bash

# Apache: prevent PHP execution inside the uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent inside the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}