CVE-2024-12610
📋 TL;DR
This vulnerability in the School Management System for WordPress plugin allows unauthenticated attackers to delete arbitrary posts due to missing capability checks on AJAX endpoints. All WordPress sites using this plugin up to version 93.0.0 are affected. Attackers can exploit this without any authentication.
💻 Affected Systems
- School Management System for WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete website content deletion, including critical pages, posts, and custom post types managed by the plugin, potentially causing business disruption and data loss.
Likely Case
Selective deletion of important posts/pages, defacement, or removal of content to disrupt operations or cause reputational damage.
If Mitigated
Limited impact if proper web application firewalls and access controls are in place to block unauthenticated AJAX requests.
🎯 Exploit Status
Exploitation requires sending crafted AJAX requests to vulnerable endpoints. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 93.0.0
Vendor Advisory: https://codecanyon.net/item/school-management-system-for-wordpress/11470032
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'School Management System for WordPress'
4. Click 'Update Now' if update available
5. If no update available, deactivate and remove plugin immediately
🔧 Temporary Workarounds
Block vulnerable AJAX endpoints
allUse web application firewall or .htaccess to block access to the vulnerable AJAX actions
# Add to .htaccess or WAF rules:
RewriteCond %{QUERY_STRING} (mj_smgt_remove_feetype|mj_smgt_remove_category_new) [NC]
RewriteRule .* - [F,L]
Disable plugin
linuxTemporarily deactivate the plugin until patched
wp plugin deactivate school-management-system
🧯 If You Can't Patch
- Implement strict web application firewall rules to block unauthenticated AJAX requests
- Enable comprehensive logging and monitoring for post deletion activities
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → School Management System for WordPress. If version is 93.0.0 or lower, you are vulnerable.Check Version:
wp plugin get school-management-system --field=versionVerify Fix Applied:
After update, verify plugin version is higher than 93.0.0. Test AJAX endpoints with unauthenticated requests should return proper authorization errors.📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=mj_smgt_remove_feetype or mj_smgt_remove_category_new from unauthenticated users
- Sudden increase in post deletions or trash operations
Network Indicators:
- Unusual AJAX requests to WordPress admin endpoints from external IPs without authentication cookies
SIEM Query:
source="web_logs" AND uri="/wp-admin/admin-ajax.php" AND (query_string="*mj_smgt_remove_feetype*" OR query_string="*mj_smgt_remove_category_new*") AND NOT user_agent="*bot*"