The Rate My Post – Star Rating Plugin by FeedbackWP, widely used in WordPress environments to enable star rating functionality on posts, suffers from an authorization bypass vulnerability identified as CVE-2024-12309. This vulnerability arises from an insecure direct object reference (IDOR), classified under CWE-639, where the plugin fails to properly validate a user-controlled key parameter passed to the get_post_status() function. As a result, unauthenticated attackers can manipulate this parameter to cast votes on posts that are unpublished or scheduled, which should normally be restricted. The flaw exists in all plugin versions up to and including 4.2.4. The vulnerability is remotely exploitable without any authentication or user interaction, increasing its risk profile. Although the vulnerability does not expose sensitive data or disrupt service availability, it compromises the integrity of the rating system by allowing unauthorized manipulation of post ratings. This can undermine trust in the content and skew user feedback metrics. No patches or fixes are currently linked, and no exploits have been reported in the wild, but the presence of this vulnerability in a popular WordPress plugin necessitates immediate attention from site administrators.

The primary impact of CVE-2024-12309 is on the integrity of content ratings within WordPress sites using the affected plugin. Attackers can artificially inflate or deflate ratings on unpublished or scheduled posts, potentially misleading site visitors or administrators about the quality or popularity of content before it is publicly available. This can damage the credibility of the website, distort user feedback mechanisms, and affect decision-making based on rating data. While confidentiality and availability are not directly impacted, the manipulation of ratings could be leveraged in broader disinformation or reputation sabotage campaigns. For organizations relying heavily on user-generated ratings for content promotion or e-commerce, this could translate into financial or reputational losses. The ease of exploitation without authentication increases the likelihood of automated or mass exploitation attempts, particularly on high-traffic WordPress sites.

To mitigate this vulnerability, organizations should immediately update the Rate My Post – Star Rating Plugin to a patched version once it becomes available. In the absence of an official patch, administrators can implement temporary workarounds such as restricting access to the rating functionality via web application firewall (WAF) rules that block suspicious requests targeting the get_post_status() parameter. Additionally, monitoring and logging rating activity on unpublished or scheduled posts can help detect anomalous voting patterns indicative of exploitation. Site owners should also consider disabling the rating feature on unpublished content until a fix is applied. Reviewing and tightening access controls and input validation within custom or third-party plugins can prevent similar IDOR issues. Regular security audits and plugin vulnerability monitoring are recommended to promptly identify and address such risks.