CVE-2024-12071 – This vulnerability in the Evergreen Content Pos... (How to Fix)

Q: What is the severity of CVE-2024-12071?

CVE-2024-12071 has a CVSS score of 5.3 (MEDIUM). This vulnerability in the Evergreen Content Poster WordPress plugin allows unauthenticated attackers to delete arbitrary posts and pages due to missing capability checks. All WordPress sites using this plugin up to version 1.4.4 are affected. The flaw enables unauthorized data destruction without requiring any authentication.

📋 TL;DR

This vulnerability in the Evergreen Content Poster WordPress plugin allows unauthenticated attackers to delete arbitrary posts and pages due to missing capability checks. All WordPress sites using this plugin up to version 1.4.4 are affected. The flaw enables unauthorized data destruction without requiring any authentication.

💻 Affected Systems

Products:

Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media WordPress plugin

Versions: All versions up to and including 1.4.4

Operating Systems: Any OS running WordPress (Linux, Windows, etc.)

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects WordPress installations with the vulnerable plugin enabled. No special configuration required for exploitation.

📦 What is this software?

Evergreen Content Poster by Evergreencontentposter

View all CVEs affecting Evergreen Content Poster →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete website defacement through mass deletion of all posts and pages, causing permanent data loss and significant business disruption.

🟠

Likely Case

Selective deletion of important content, leading to website downtime, SEO damage, and content recovery costs.

🟢

If Mitigated

Minimal impact if plugin is disabled or patched before exploitation, with potential for audit trail detection.

🌐 Internet-Facing: HIGH - WordPress sites are typically internet-facing, and the vulnerability requires no authentication.

🏢 Internal Only: LOW - The vulnerability affects WordPress plugins, which are typically deployed on internet-facing web servers.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY - Simple unauthenticated HTTP request to vulnerable endpoint makes weaponization straightforward.

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW - Requires only a single HTTP request to the vulnerable delete_network_post() function.

Exploitation is trivial - attackers can send crafted requests to the plugin's vulnerable endpoint without any authentication.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 1.4.5 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3224190%40evergreen-content-poster&new=3224190%40evergreen-content-poster&sfp_email=&sfph_mail=

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Evergreen Content Poster' and click 'Update Now'. 4. Verify plugin version is 1.4.5 or higher.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily deactivate the Evergreen Content Poster plugin until patched.

wp plugin deactivate evergreen-content-poster

Web application firewall rule

all

Block requests to the vulnerable delete_network_post() endpoint.

Add WAF rule to block: POST requests containing 'delete_network_post' action

🧯 If You Can't Patch

Disable the Evergreen Content Poster plugin immediately
Implement strict network access controls to limit access to WordPress admin functions

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Evergreen Content Poster → Version. If version is 1.4.4 or lower, you are vulnerable.

Check Version:

wp plugin get evergreen-content-poster --field=version

Verify Fix Applied:

After updating, verify plugin version shows 1.4.5 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

HTTP POST requests to /wp-admin/admin-ajax.php with 'action=delete_network_post' parameter
Unexpected post/page deletions in WordPress logs
404 errors for previously existing content

Network Indicators:

Unusual POST requests to WordPress admin-ajax.php from unauthenticated sources
Burst of DELETE operations in short timeframes

SIEM Query:

source="wordpress.log" AND "delete_network_post" AND NOT user!="unauthenticated"

📊 Metadata

CVE ID: CVE-2024-12071

CVSS v3 Score: 5.3 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE: CWE-862

EPSS Score: 0.09% exploit probability (26th percentile)

Published: January 18, 2025

Last Updated: February 25, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-12071, you might also want to check these: