CVE-2024-12071 is a vulnerability classified under CWE-862 (Missing Authorization) affecting the Evergreen Content Poster WordPress plugin, which automates posting and scheduling content to social media. The flaw exists in the delete_network_post() function, which lacks proper capability checks to verify if the user is authorized to delete posts or pages. This absence of authorization allows unauthenticated attackers to invoke this function and delete arbitrary content on the affected WordPress sites. The vulnerability affects all versions up to and including 1.4.4. The CVSS v3.1 base score is 5.3 (medium severity), reflecting that the attack vector is network-based (remote), requires no privileges or user interaction, and impacts integrity but not confidentiality or availability. The scope remains unchanged as the vulnerability affects only the vulnerable plugin component. No patches or fixes are currently linked, and no known exploits have been reported in the wild. This vulnerability can lead to content loss and potential disruption of website operations, especially for sites relying heavily on scheduled social media content management.

The primary impact of CVE-2024-12071 is the unauthorized deletion of posts and pages, which compromises the integrity of website content. For organizations, this can result in loss of critical marketing materials, disruption of scheduled social media campaigns, and damage to brand reputation. Although the vulnerability does not affect confidentiality or availability directly, the loss of content can indirectly affect business operations and user trust. Attackers exploiting this flaw could selectively remove important posts, causing confusion or misinformation if content is removed unexpectedly. Organizations relying on this plugin for social media automation are particularly vulnerable, and recovery may require manual restoration of deleted content, leading to operational downtime and increased administrative overhead.

To mitigate this vulnerability, organizations should immediately audit their WordPress installations for the presence of the Evergreen Content Poster plugin and verify the version in use. Until an official patch is released, consider disabling or uninstalling the plugin to prevent exploitation. Restrict plugin management capabilities strictly to trusted administrators and implement web application firewalls (WAFs) with rules to detect and block unauthorized requests targeting the delete_network_post() function. Monitor website logs for suspicious deletion requests originating from unauthenticated sources. Additionally, maintain regular backups of website content to enable rapid restoration in case of unauthorized deletions. Once a patch or update is available from the vendor, apply it promptly. Consider employing security plugins that enforce capability checks and enhance authorization controls for plugin functions.