CVE-2024-12610 Overview
CVE-2024-12610 affects the School Management System for WordPress plugin developed by Dasinfomedia. The plugin fails to enforce capability checks on the mj_smgt_remove_feetype and mj_smgt_remove_category_new AJAX actions. Unauthenticated attackers can invoke these actions to delete arbitrary posts from affected WordPress sites. The flaw exists in all versions up to and including 93.0.0. The vulnerability is classified as Missing Authorization [CWE-862] and is exploitable remotely over the network without user interaction.
Critical Impact
Unauthenticated remote attackers can delete arbitrary posts on affected WordPress sites, causing loss of site content and potential disruption of school operations.
Affected Products
- Dasinfomedia School Management System for WordPress plugin, all versions up to and including 93.0.0
- WordPress installations with the vulnerable plugin activated
- Sites relying on the plugin's fee type and category management features
Discovery Timeline
- 2025-03-07 - CVE-2024-12610 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12610
Vulnerability Analysis
The vulnerability resides in two AJAX handlers registered by the School Management System for WordPress plugin: mj_smgt_remove_feetype and mj_smgt_remove_category_new. Both handlers process deletion requests without verifying whether the calling user holds the required capabilities. WordPress exposes AJAX endpoints via wp-admin/admin-ajax.php, and handlers registered under wp_ajax_nopriv_* are reachable by unauthenticated visitors. Because neither a current_user_can() check nor a nonce validation gates the destructive action, any remote actor can send a crafted POST request to trigger arbitrary post deletion.
Root Cause
The root cause is a Missing Authorization flaw [CWE-862]. The plugin developers implemented AJAX endpoints to support removal of fee types and categories but did not include the capability checks required for privileged operations. Delete actions execute against the object identifier supplied in the request, allowing attackers to target arbitrary post IDs rather than only records associated with the plugin's intended data model.
Attack Vector
Exploitation requires only network access to the target WordPress site. An attacker crafts an HTTP POST request to admin-ajax.php specifying the action parameter as mj_smgt_remove_feetype or mj_smgt_remove_category_new along with a target identifier. The server processes the request without authenticating or authorizing the caller and deletes the referenced post. No credentials, tokens, or social engineering are required. Full technical details are available in the Wordfence Vulnerability Analysis.
Detection Methods for CVE-2024-12610
Indicators of Compromise
- Unexpected POST requests to /wp-admin/admin-ajax.php containing action=mj_smgt_remove_feetype or action=mj_smgt_remove_category_new
- Unexplained deletion of posts, pages, or plugin-managed records in the WordPress database
- Entries in web server access logs originating from unauthenticated sessions targeting the vulnerable AJAX actions
Detection Strategies
- Monitor WordPress audit logs for post deletion events not tied to an authenticated administrator session
- Inspect HTTP access logs for repeated calls to admin-ajax.php referencing the two vulnerable action names
- Enumerate installed plugins across managed WordPress sites and flag any Dasinfomedia School Management System build at version 93.0.0 or earlier
Monitoring Recommendations
- Deploy a web application firewall rule that blocks unauthenticated requests to the affected AJAX actions
- Enable WordPress activity logging to capture post lifecycle events with actor attribution
- Track database counts of critical post types and alert on unexpected drops that may indicate mass deletion
How to Mitigate CVE-2024-12610
Immediate Actions Required
- Update the School Management System for WordPress plugin to a version later than 93.0.0 as soon as a patched release is available from Dasinfomedia
- Restrict access to wp-admin/admin-ajax.php at the network or WAF layer where feasible
- Take a full backup of the WordPress database and uploads directory before applying changes
Patch Information
At the time of publication, no fixed version is listed in the NVD entry. Administrators should consult the vendor's CodeCanyon product page and the Wordfence Vulnerability Analysis for the latest patch guidance and apply the update immediately once released.
Workarounds
- Deactivate the School Management System for WordPress plugin until a patched version is installed
- Add WAF signatures that block unauthenticated POST requests where the action parameter equals mj_smgt_remove_feetype or mj_smgt_remove_category_new
- Restrict access to the WordPress site using IP allowlists or authentication proxies while remediation is pending
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
