CVE-2024-12881 is a critical vulnerability affecting all versions up to and including 0.0.7 of the 'PlugVersions – Easily rollback to previous versions of your plugins' WordPress plugin developed by giuse. The root cause is a missing capability check (authorization) in the eos_plugin_reviews_restore_version() function, which is responsible for restoring previous plugin versions. Due to this missing authorization, any authenticated user with at least Subscriber-level privileges can exploit the vulnerability to upload arbitrary files to the server. This arbitrary file upload can be leveraged to execute malicious code, potentially leading to full site compromise including data theft, defacement, or further pivoting within the hosting environment. The vulnerability is remotely exploitable over the network without requiring user interaction beyond authentication, which is relatively easy to obtain on many WordPress sites due to common user registrations or weak credential policies. The CVSS v3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability, combined with low attack complexity and low privileges required. No patches or fixes have been published at the time of disclosure, and no known exploits are currently reported in the wild. This vulnerability falls under CWE-862 (Missing Authorization), highlighting the failure to properly restrict access to sensitive functionality. Given the widespread use of WordPress and the plugin’s functionality, this vulnerability poses a significant risk to many websites worldwide.

The impact of CVE-2024-12881 is severe for organizations running WordPress sites with the vulnerable PlugVersions plugin. Attackers with minimal privileges can escalate their access by uploading arbitrary files, leading to remote code execution, data breaches, site defacement, or complete takeover of the web server. This compromises the confidentiality of sensitive data stored or processed by the site, the integrity of website content and configurations, and the availability of the service. For e-commerce, financial, healthcare, or government websites, such a compromise could result in significant financial losses, reputational damage, regulatory penalties, and operational disruptions. The ease of exploitation and the low privilege requirement increase the likelihood of attacks, especially on sites that allow user registrations or have weak access controls. Additionally, compromised sites can be used as launchpads for further attacks against internal networks or other connected systems, amplifying the threat. The absence of a patch means organizations must rely on temporary mitigations, increasing exposure time. Overall, this vulnerability represents a critical risk to the security posture of affected WordPress installations globally.

Until an official patch is released, organizations should implement several specific mitigations to reduce risk: 1) Restrict plugin usage to trusted administrators only by disabling or removing the plugin on sites where it is not essential. 2) Harden user access controls by limiting Subscriber-level accounts and reviewing user roles to ensure minimal privileges. 3) Monitor web server and WordPress logs for unusual file uploads or suspicious activity related to plugin version restoration functions. 4) Employ Web Application Firewalls (WAFs) with custom rules to detect and block requests targeting the eos_plugin_reviews_restore_version() function or unusual POST requests that could indicate exploitation attempts. 5) Disable or restrict file write permissions on the WordPress installation directories where possible to prevent unauthorized file creation. 6) Educate site administrators about the risk and encourage immediate removal or deactivation of the vulnerable plugin until a patch is available. 7) Regularly back up website data and configurations to enable rapid recovery in case of compromise. 8) Stay alert for updates from the plugin vendor or WordPress security advisories and apply patches promptly once released. These targeted actions go beyond generic advice by focusing on access control tightening, monitoring, and proactive defense tailored to the vulnerability’s exploitation vector.