CVE-2024-12269 is a vulnerability classified under CWE-862 (Missing Authorization) found in the Safe Ai Malware Protection for WP plugin for WordPress. The vulnerability exists because the export_db() function lacks a capability check, meaning it does not verify whether the requester has the necessary permissions to perform a database export. This flaw affects all versions up to and including 1.0.17. As a result, unauthenticated attackers can invoke this function remotely and retrieve a complete dump of the WordPress site's database. The database dump may contain sensitive information such as user credentials, personal data, site configuration, and potentially other secrets stored within the database. The vulnerability has a CVSS v3.1 base score of 7.5, indicating high severity, with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, meaning it is remotely exploitable over the network without any privileges or user interaction, and it impacts confidentiality but not integrity or availability. No patches or fixes were linked at the time of publication, and no known exploits have been reported in the wild. The vulnerability is critical for organizations relying on this plugin, especially those with sensitive or regulated data stored in their WordPress databases.

The primary impact of CVE-2024-12269 is the unauthorized disclosure of sensitive data stored in the WordPress database. This can lead to significant data breaches, exposing user personal information, authentication credentials, and site configuration details. Such exposure can facilitate further attacks, including account takeover, privilege escalation, or targeted phishing campaigns. The confidentiality impact is high, while integrity and availability remain unaffected. Organizations worldwide using this plugin are at risk, particularly those in sectors handling sensitive or regulated data such as finance, healthcare, and e-commerce. The ease of exploitation (no authentication or user interaction required) increases the likelihood of automated scanning and exploitation attempts. Although no known exploits are reported yet, the vulnerability’s public disclosure may prompt attackers to develop exploit tools rapidly. This could result in widespread data breaches and reputational damage for affected organizations.

Until an official patch is released, organizations should immediately disable the Safe Ai Malware Protection for WP plugin to prevent exploitation. Monitor for updates from the vendor and apply patches as soon as they become available. Conduct a thorough audit of WordPress installations to identify the presence of this plugin and its version. Restrict access to WordPress administrative endpoints using web application firewalls (WAFs) or IP whitelisting to reduce exposure. Implement database encryption and ensure backups are securely stored to mitigate data exposure risks. Regularly monitor logs for unusual export_db() function calls or suspicious activity. Educate site administrators about the risks and encourage prompt plugin updates. Consider alternative malware protection plugins with verified security postures until this issue is resolved.