CVE-2024-12471
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Tags
Description
The Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator plugin for WordPress is vulnerable to arbitrary files uploads due to a missing capability check and file type validation on the add_image_to_library AJAX action function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files that make remote code execution possible.
Analysis
The Post Saint AI content generator WordPress plugin through version 1.3.1 allows authenticated subscribers to upload arbitrary files via the add_image_to_library AJAX action. A missing capability check combined with no file type validation enables low-privilege users to deploy PHP webshells and achieve remote code execution.
Technical Context
The add_image_to_library AJAX action is intended for adding AI-generated images to the WordPress media library. It lacks a capability check (any authenticated user including subscribers can call it) and performs no file type validation. An attacker with a subscriber account can upload PHP files that are stored in the media library and accessible via HTTP.
Affected Products
['Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo <= 1.3.1']
Remediation
Update the plugin or remove it if not actively used. Implement file type validation on all upload endpoints. Restrict AJAX actions to appropriate user roles. Scan the media library for PHP files.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today