CVE-2024-12848: SKT Page Builder WordPress RCE Vulnerability

CVE-2024-12848 Overview

CVE-2024-12848 affects the SKT Page Builder plugin for WordPress in all versions up to and including 4.6. The vulnerability exists in the addLibraryByArchive function, which lacks a proper capability check [CWE-862]. Authenticated attackers holding subscriber-level access or above can upload arbitrary files to the WordPress site. Successful exploitation enables remote code execution on the underlying web server. The flaw stems from missing authorization controls rather than input validation, allowing any low-privileged authenticated user to bypass the plugin's intended administrative restrictions.

Critical Impact
Authenticated subscriber-level attackers can upload arbitrary files through the SKT Page Builder plugin and achieve remote code execution on affected WordPress installations.

Affected Products

SKT Page Builder WordPress plugin versions up to and including 4.6
WordPress installations with the skt-builder plugin activated
Sites permitting subscriber-level registration where the plugin is installed

Discovery Timeline

2025-01-09 - CVE-2024-12848 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12848

Vulnerability Analysis

The vulnerability resides in the addLibraryByArchive function within sktbuilder.php of the SKT Page Builder plugin. This function handles archive-based library imports but does not verify that the calling user possesses administrative privileges. WordPress capability checks such as current_user_can() are absent from the function's entry point. Any authenticated user, including those registered as subscribers, can invoke the function through AJAX endpoints exposed by the plugin.

Because the function accepts and extracts archive uploads, an attacker can package a PHP payload inside an archive and have it written into a web-accessible directory. Once extracted, the attacker requests the uploaded PHP file directly, triggering code execution under the web server's user context.

Root Cause

The root cause is a missing authorization check [CWE-862] on a privileged file-handling function. The plugin exposes addLibraryByArchive to authenticated AJAX callers without validating user roles or nonces sufficient to restrict access to administrators. This design flaw treats authentication alone as authorization, ignoring WordPress's role-based capability model.

Attack Vector

An attacker first obtains any authenticated session, typically by registering an account when public registration is enabled with default subscriber role. The attacker then issues a crafted AJAX POST request to the plugin's endpoint that invokes addLibraryByArchive, supplying a malicious ZIP archive containing a PHP web shell. The plugin extracts the archive into the WordPress uploads directory. The attacker then requests the extracted PHP file over HTTP, executing arbitrary commands. Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Code Review for the vulnerable code path.

Detection Methods for CVE-2024-12848

Indicators of Compromise

Unexpected PHP files present under wp-content/uploads/ or plugin library directories
POST requests to plugin AJAX handlers referencing addLibraryByArchive originating from low-privilege user sessions
ZIP archive uploads followed by direct HTTP GET requests to newly created .php files
New or modified WordPress subscriber accounts making administrative-style requests

Detection Strategies

Inspect web server access logs for AJAX calls invoking addLibraryByArchive from non-administrator accounts
Monitor file integrity in WordPress content directories for newly written executable PHP files
Alert on archive extraction operations that produce PHP files outside expected plugin directories
Correlate subscriber-level authentication events with subsequent file upload activity

Monitoring Recommendations

Enable WordPress audit logging for plugin AJAX actions and user role changes
Forward web server and PHP execution logs to a central analytics platform for anomaly detection
Track outbound network connections from the PHP-FPM or web server process to catch post-exploitation callbacks

How to Mitigate CVE-2024-12848

Immediate Actions Required

Update the SKT Page Builder plugin to a version released after 4.6 that includes the capability check fix
Audit WordPress user accounts and remove untrusted subscriber-level accounts
Scan wp-content/uploads/ and plugin directories for unauthorized PHP files and remove them
Rotate WordPress secret keys and administrator credentials if compromise is suspected

Patch Information

The plugin author addressed the missing capability check in the changesets referenced by the WordPress plugin repository. Review the WordPress Changeset Update 3213786 and WordPress Changeset Update 3218995 for the specific code changes that introduced the authorization check.

Workarounds

Deactivate and remove the SKT Page Builder plugin until it can be updated to a fixed version
Disable public user registration or restrict the default new-user role to prevent unauthenticated actors from obtaining subscriber accounts
Apply a web application firewall rule to block requests to the plugin's addLibraryByArchive action from non-administrator sessions
Deny PHP execution in the wp-content/uploads/ directory via web server configuration

bash

# Configuration example: block PHP execution in WordPress uploads (Apache .htaccess)
<Files *.php>
    Require all denied
</Files>