CVE-2024-12252 affects the SEO LAT Auto Post plugin for WordPress by allowing unauthenticated attackers to overwrite a critical plugin file through the remote_update AJAX action, which lacks proper capability checks. This improper control of code generation (CWE-94) can be exploited to achieve remote code execution. The vulnerability impacts all versions up to and including 2.2.1. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting a network attack vector with no privileges or user interaction required and full confidentiality, integrity, and availability impact. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation allows unauthenticated remote attackers to overwrite the seo-beginner-auto-post.php file, potentially leading to full remote code execution on the affected WordPress site. This compromises confidentiality, integrity, and availability of the system. Given the critical CVSS score, the impact is severe, enabling attackers to fully control the vulnerable server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable AJAX endpoint if possible, and consider disabling or removing the SEO LAT Auto Post plugin to prevent exploitation. Monitor official channels for updates from the vendor or WordPress plugin repository regarding patches or mitigations.