CVE-2024-12848 is a critical vulnerability found in the SKT Page Builder plugin for WordPress, specifically in all versions up to and including 4.6. The root cause is a missing authorization check (CWE-862) in the 'addLibraryByArchive' function, which is responsible for handling file uploads. Due to this missing capability check, any authenticated user with at least subscriber-level privileges can upload arbitrary files to the server. This arbitrary file upload can be leveraged to achieve remote code execution (RCE), allowing attackers to execute malicious code on the web server hosting the WordPress site. The vulnerability does not require user interaction and can be exploited remotely over the network (AV:N), with low attack complexity (AC:L). The CVSS v3.1 score of 8.8 reflects high impact on confidentiality, integrity, and availability, as attackers can compromise the entire system, steal sensitive data, modify content, or disrupt service. Although no public exploits have been reported yet, the vulnerability's nature and ease of exploitation make it a critical risk for websites using this plugin. The lack of a patch link suggests that users must monitor vendor updates closely or consider temporary mitigations such as restricting plugin usage or user permissions.

The impact of CVE-2024-12848 is severe for organizations running WordPress sites with the SKT Page Builder plugin installed. Successful exploitation allows attackers to upload arbitrary files, leading to remote code execution, which can result in full system compromise. This threatens the confidentiality of sensitive data stored or processed by the website, the integrity of website content and backend systems, and the availability of the web service. Attackers could deploy web shells, pivot to internal networks, deface websites, steal user credentials, or launch further attacks. Given WordPress's widespread use globally, this vulnerability could affect a large number of websites, including corporate, governmental, and e-commerce platforms. The requirement for only subscriber-level access lowers the barrier for exploitation, increasing risk from insider threats or compromised low-privilege accounts.

To mitigate this vulnerability, organizations should immediately verify if they use the SKT Page Builder plugin and identify the version in use. Since no official patch is currently linked, users should: 1) Restrict plugin access strictly to trusted administrators and remove or downgrade subscriber-level permissions where possible. 2) Disable or uninstall the SKT Page Builder plugin until a security update is released. 3) Implement Web Application Firewall (WAF) rules to detect and block suspicious file upload attempts targeting the vulnerable function. 4) Monitor server logs for unusual file uploads or execution patterns indicative of exploitation attempts. 5) Harden WordPress installations by enforcing the principle of least privilege for all user roles. 6) Regularly back up website data and test restoration procedures to recover quickly from potential compromises. 7) Stay alert for vendor announcements or security advisories providing patches or further guidance.