CVE-2024-12269: 
WordPress vulnerability analysis and mitigation

The Safe Ai Malware Protection for WP plugin for WordPress contains a critical security vulnerability (CVE-2024-12269) discovered in January 2025. The vulnerability affects all versions up to and including 1.0.17, and is characterized by unauthorized access to data due to a missing capability check in the export_db() function. This security flaw has been assigned a CVSS v3.1 base score of 7.5 (High) (Wordfence).

The vulnerability stems from a missing authorization check in the export_db() function, which is classified as CWE-862 (Missing Authorization). The vulnerability has a CVSS v3.1 vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating that it can be exploited remotely with low attack complexity, requires no privileges or user interaction, and primarily impacts data confidentiality (NVD).

The vulnerability allows unauthenticated attackers to retrieve a complete dump of the site's database, potentially exposing sensitive information stored within the WordPress installation (NVD).

The vulnerability can be exploited by unauthenticated attackers, requiring no special privileges or user interaction. The attack vector is network-accessible and has low complexity, making it relatively straightforward to exploit (Wordfence).

A patch has been made available through the WordPress plugin repository. Users are advised to update their Safe Ai Malware Protection for WP plugin to a version newer than 1.0.17 (WordPress Plugin).