CVE-2024-12544 is a high-severity vulnerability (CVSS 8.8) in the SurveyJS: Drag & Drop Form Builder WordPress plugin by devsoftbaltic. The issue stems from a missing authorization check in the SurveyJS_DeleteFile class callback, permitting authenticated users with low privileges (Subscriber-level and above) to delete arbitrary files on the server. This can escalate to remote code execution if critical files are removed. Additionally, the function is vulnerable to CSRF attacks as of version 1.12.20, increasing the risk of unauthorized file deletions without user interaction. The vulnerability affects all versions up to and including 1.12.17. No patch or official fix information is provided in the available data.

Authenticated users with Subscriber-level access or higher can delete arbitrary files on the server, potentially leading to remote code execution if key files such as wp-config.php are deleted. The lack of authorization checks combined with CSRF vulnerability increases the risk of exploitation. This can compromise the integrity, confidentiality, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for suspicious activity related to file deletions. Consider disabling or removing the plugin if possible to prevent exploitation. Implement additional access controls or web application firewall (WAF) rules to block unauthorized file deletion attempts.