AVID-2026-R1385

Description

Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload (CVE-2024-12471)

Details

The Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator plugin for WordPress is vulnerable to arbitrary files uploads due to a missing capability check and file type validation on the add_image_to_library AJAX action function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files that make remote code execution possible.

Reason for inclusion in AVID: The CVE describes an authenticated arbitrary file upload vulnerability (leading to remote code execution) in a WordPress plugin that integrates AI tools (ChatGPT, GPT-4, DALL-E, Stable Diffusion). This plugin is used to deploy AI-generated content, making it a component within AI software stacks. The vulnerability affects a software supply chain component used to build/run AI features on websites, and constitutes a security vulnerability with clear exploitation potential.

References

Affected or Relevant Artifacts

Developer: OpenAI
Deployer: OpenAI
Artifact Details:

Type	Name
System	Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score	8.8
Base Severity	🔴 High

CWE

ID	Description
CWE-94	CWE-94 Improper Control of Generation of Code (‘Code Injection’)

Other information

Report Type: Advisory
Credits:
Date Reported: 2025-01-07
Version: 0.3.3
AVID Entry