CVE-2024-12881 is a missing authorization vulnerability (CWE-862) in the PlugVersions – Easily roll back to previous versions of your plugins WordPress plugin by giuse. The eos_plugin_reviews_restore_version() function does not properly verify user capabilities, allowing authenticated users with low privileges (Subscriber-level and above) to upload arbitrary files by leveraging local file inclusion. This can lead to complete compromise of the affected WordPress site. The vulnerability affects all versions up to and including 0.0.7. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with Subscriber-level access or higher can upload arbitrary files to the WordPress site, potentially leading to full site compromise including data theft, site defacement, or denial of service. The vulnerability affects confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin usage to trusted users only and consider disabling or removing the plugin if possible. Monitor for updates from the vendor or plugin author and apply patches promptly once available.