CVE-2024-12309

Summary

CVE-2024-12309 is a vulnerability affecting the Rate My Post – Star Rating Plugin by FeedbackWP for WordPress. This issue, present in versions up to 4.2.4, allows unauthenticated attackers to manipulate unpublished scheduled posts through an Insecure Direct Object Reference in the get_post_status() function. The lack of validation on a user-controlled key enables the attacker to access and vote on these posts, potentially disrupting workflows and causing unintended publicity.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.