CVE-2024-12881 Overview
CVE-2024-12881 affects the PlugVersions WordPress plugin, which allows administrators to roll back plugins to previous versions. The vulnerability stems from a missing capability check on the eos_plugin_reviews_restore_version() function in all versions up to and including 0.0.7. Authenticated users with Subscriber-level access or higher can create arbitrary files on the server by leveraging locally included files. The flaw is categorized under [CWE-862] Missing Authorization. Successful exploitation can lead to remote code execution when attackers write PHP files to web-accessible directories.
Critical Impact
Authenticated Subscriber-level users can create arbitrary files on the server, enabling remote code execution and full site takeover.
Affected Products
- PlugVersions – Easily rollback to previous versions of your plugins (WordPress plugin)
- All versions up to and including 0.0.7
- WordPress sites permitting Subscriber-level registration are at highest risk
Discovery Timeline
- 2024-12-24 - CVE-2024-12881 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12881
Vulnerability Analysis
The vulnerability resides in the eos_plugin_reviews_restore_version() function within the PlugVersions plugin. This function handles the plugin rollback workflow but lacks a WordPress capability check to verify that the caller has administrative privileges. Any authenticated user, including a Subscriber, can invoke the function through the plugin's registered AJAX or admin endpoint.
The function processes user-controlled input to determine which file to restore. Because it references local files during the restoration flow, an attacker can steer the process to write attacker-influenced content to arbitrary locations. Writing a PHP file within the WordPress webroot converts the file-upload primitive into remote code execution.
Root Cause
The root cause is the absence of a current_user_can() check and the absence of a nonce verification within eos_plugin_reviews_restore_version(). WordPress plugins that expose privileged file operations must gate them behind explicit capability checks such as manage_options or update_plugins. The developer relied on the endpoint being reached only from administrative UI contexts rather than enforcing authorization server-side.
Attack Vector
Exploitation requires a valid WordPress account at the Subscriber tier or above. On sites with open user registration, this prerequisite is trivially satisfied. The attacker authenticates, then issues an HTTP request to the plugin's endpoint that invokes the vulnerable function with crafted parameters. The server writes a file the attacker controls to a chosen path. The attacker then requests that file to execute arbitrary PHP under the web server user.
No verified proof-of-concept code has been published. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the code-level fix.
Detection Methods for CVE-2024-12881
Indicators of Compromise
- Unexpected .php files under wp-content/plugins/, wp-content/uploads/, or the PlugVersions plugin directory with recent modification timestamps
- Web server access logs showing authenticated POST requests to admin-ajax.php referencing the eos_plugin_reviews_restore_version action from low-privilege user sessions
- New or modified plugin files that do not match the vendor-shipped file hashes for installed plugins
Detection Strategies
- Compare on-disk plugin files against the checksums published on the WordPress.org plugin repository to identify tampered or added files
- Alert on WordPress users at Subscriber or Contributor role invoking admin-scoped AJAX actions, which is anomalous by design
- Inspect web server and PHP error logs for file writes originating from PHP processes into unexpected paths
Monitoring Recommendations
- Enable WordPress audit logging to capture role, action, and endpoint for every authenticated request
- Forward web server, PHP-FPM, and WordPress logs into a centralized analytics platform for correlation across user role and file-system events
- Baseline the plugin directory and alert on any file creation or modification outside a planned update window
How to Mitigate CVE-2024-12881
Immediate Actions Required
- Update the PlugVersions plugin to a version newer than 0.0.7 as soon as a patched release is published, or remove the plugin if no fixed release is available
- Disable open user registration on WordPress sites that do not require it, or restrict new registrations to trusted roles below Subscriber capability
- Audit wp-content/ for unexpected PHP files created on or after 2024-12-24 and remove any that are not vendor-shipped
Patch Information
The WordPress Plugin Changeset referenced by the advisory contains the code-level fix for the missing capability check. Administrators should apply the fixed release from the WordPress.org plugin repository. Refer to the Wordfence Vulnerability Report for the authoritative fixed-version reference.
Workarounds
- Deactivate and remove the PlugVersions plugin until a patched version is installed
- Restrict access to wp-admin/admin-ajax.php for unauthenticated and Subscriber-tier sessions using a web application firewall rule that blocks the eos_plugin_reviews_restore_version action
- Set the WordPress file-system constant define('DISALLOW_FILE_MODS', true); in wp-config.php to block plugin-driven file operations until the site is patched
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
