CVE-2024-12252 – SEO LAT Auto Post <= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution)

https://notcve.org/view.php?id=CVE-2024-12252

06 Jan 2025 — The SEO LAT Auto Post plugin for WordPress is vulnerable to file overwrite due to a missing capability check on the remote_update AJAX action in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to overwrite the seo-beginner-auto-post.php file which can be leveraged to achieve remote code execution. El complemento SEO LAT Auto Post para WordPress es vulnerable a la sobrescritura de archivos debido a una falta de verificación de capacidad en la acción AJAX remote_... • https://github.com/RandomRobbieBF/CVE-2024-12252 • CWE-94: Improper Control of Generation of Code ('Code Injection') •