cve/2024/CVE-2024-12471.md

### [CVE-2024-12471](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-12471)
![](https://img.shields.io/static/v1?label=Product&message=Post%20Saint%3A%20ChatGPT%2C%20GPT4%2C%20DALL-E%2C%20Stable%20Diffusion%2C%20Pexels%2C%20Dezgo%20AI%20Text%20%26%20Image%20Generator&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=*%3C%3D%201.3.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%20Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brighgreen)

### Description

The Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator plugin for WordPress is vulnerable to arbitrary files uploads due to a missing capability check and file type validation on the add_image_to_library AJAX action function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files that make remote code execution possible.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/Nxploited/CVE-2024-1247-PoC
- https://github.com/RandomRobbieBF/CVE-2024-12471