Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-12544: SurveyJS WordPress Plugin Allows Unauthenticated File Deletion

CVE-2024-12544 · published 1 year ago

Summary

The SurveyJS WordPress plugin has a security flaw that lets attackers delete any file on the server, which could lead to serious problems like hackers taking control of your site. This is possible because the plugin doesn't check who is trying to delete files. To fix this, update to a newer version of the plugin that has the security patch.

Original advisory text

The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to arbitrary file deletion due to a missing capability check on the callback function of the SurveyJS_DeleteFile class in all versions up to, and including, 1.12.17. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This function is still vulnerable to Cross-Site Request Forgery as of 1.12.20.

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published1 Mar 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-12544 · NVD

Track software like this

Free during beta