CVE-2024-12471 is a code injection vulnerability (CWE-94) in the Post Saint WordPress plugin that enables authenticated users with low privileges (subscriber-level and above) to upload arbitrary files via the add_image_to_library AJAX action. This is due to missing capability checks and absence of file type validation, which can be exploited to achieve remote code execution. The vulnerability affects all plugin versions up to 1.3.1. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated user with subscriber-level permissions or higher to upload arbitrary files, potentially leading to remote code execution. This can compromise the affected WordPress site, resulting in full control over the server environment, data breach, or site defacement. The high CVSS score (8.8) reflects the critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and consider disabling or removing the vulnerable plugin. Monitor for updates from the vendor or WordPress plugin repository to apply any forthcoming patches promptly.