CVE-2024-12309 describes an insecure direct object reference vulnerability in the Rate My Post – Star Rating Plugin by FeedbackWP for WordPress, affecting all versions up to and including 4.2.4. The issue stems from missing validation on a user-controlled key in the get_post_status() function, which enables unauthorized users to submit votes on posts that are not yet published, such as scheduled posts. This bypasses intended authorization controls within the plugin.

The vulnerability allows unauthenticated attackers to influence the star rating of unpublished scheduled posts by voting on them. This could lead to inaccurate or manipulated rating data being recorded and displayed once the posts are published. There is no indication of confidentiality or availability impact, and no known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the plugin or restricting access to voting functionality to authenticated users only. Monitor vendor channels for updates or patches addressing this vulnerability.