CVE-2024-12252
CVSS 3.1 Score 9.8 of 10 (high)
Details
Published Jan 7, 2025
CWE ID 94
Summary
CVE-2024-12252: Unauthenticated attackers can exploit the SEO LAT Auto Post plugin for WordPress, affecting versions up to 2.2.1. This vulnerability stems from a missing capability check on the remote_update AJAX action, enabling assailants to overwrite the seo-beginner-auto-post.php file. Successful exploitation results in remote code execution.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.