What is the CVSS score of CVE-2024-12471?

CVE-2024-12471 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 62.7%.

Which versions of WordPress are affected by CVE-2024-12471?

Organizations using Image Generator face significant risk from CVE-2024-12471, a code injection vulnerability rated CVSS 8.8.

How to fix or mitigate CVE-2024-12471?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Validate that input sanitization is in place for all user-controlled parameters.

WordPress CVE-2024-12471

HIGH

Code Injection (CWE-94)

2025-01-07 security@wordfence.com

RCE Code Injection WordPress

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:02 vuln.today

CVE Published

Jan 07, 2025 - 06:15 nvd

HIGH 8.8

DescriptionCVE.org

The Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator plugin for WordPress is vulnerable to arbitrary files uploads due to a missing capability check and file type validation on the add_image_to_library AJAX action function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files that make remote code execution possible.

AnalysisAI

The Post Saint AI content generator WordPress plugin through version 1.3.1 allows authenticated subscribers to upload arbitrary files via the add_image_to_library AJAX action. A missing capability check combined with no file type validation enables low-privilege users to deploy PHP webshells and achieve remote code execution.

Technical ContextAI

The add_image_to_library AJAX action is intended for adding AI-generated images to the WordPress media library. It lacks a capability check (any authenticated user including subscribers can call it) and performs no file type validation. An attacker with a subscriber account can upload PHP files that are stored in the media library and accessible via HTTP.

Affected ProductsAI

Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo <= 1.3.1

RemediationAI

Update the plugin or remove it if not actively used. Implement file type validation on all upload endpoints. Restrict AJAX actions to appropriate user roles. Scan the media library for PHP files.