Kingsoft WPS Office promecefpluginhost.exe Improper Path Validation Remote Code Execution (CVE-2024-7262)

# Terminate active WPS Office processes to allow clean installation/update
$wpsProcesses = @('wps', 'wpp', 'et', 'promecefpluginhost')
foreach ($proc in $wpsProcesses) {
    Stop-Process -Name $proc -Force -ErrorAction SilentlyContinue
}
Write-Host 'WPS Office processes terminated. Please run the official installer to upgrade to 12.2.0.16412 or higher.'

# Restrict execution permissions on promecefpluginhost.exe using PowerShell
$targetFile = Get-ChildItem -Path 'C:\Users\*\AppData\Local\Kingsoft\WPS Office\*' -Filter 'promecefpluginhost.exe' -Recurse -ErrorAction SilentlyContinue
foreach ($file in $targetFile) {
    $acl = Get-Acl -Path $file.FullName
    $denyRule = New-Object System.Security.AccessControl.FileSystemAccessRule('Everyone', 'ExecuteFile', 'Deny')
    $acl.AddAccessRule($denyRule)
    Set-Acl -Path $file.FullName -AclObject $acl
    Write-Host 'Execution blocked for: ' $file.FullName
}

# Audit script to detect vulnerable WPS Office installations
$registryPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
Get-ItemProperty -Path $registryPaths -ErrorAction SilentlyContinue | 
Where-Object { $_.DisplayName -like '*WPS Office*' } | 
ForEach-Object {
    $version = [version]$_.DisplayVersion
    if ($version -ge [version]'12.2.0.13110' -and $version -lt [version]'12.2.0.16412') {
        Write-Warning "VULNERABLE: $($_.DisplayName) version $version detected."
    } else {
        Write-Host "SECURE: $($_.DisplayName) version $version is safe."
    }
}