Cyber Resilience

CVE-2024-12008

Medium

Published: 14 January 2025

Published
14 January 2025
Modified
16 January 2025
KEV Added
—
Patch
—
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.3984 97.4th percentile
Risk Priority 35 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-12008 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Boldgrid W3 Total Cache. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-22 (Publicly Accessible Content) and SC-14 (Public Access Protections).

Deeper analysis

The W3 Total Cache plugin for WordPress is vulnerable to information exposure in all versions through 2.8.1. The issue stems from a publicly accessible debug log file generated when the debug feature is enabled, which is disabled by default. This exposure can reveal sensitive data such as nonce values.

Unauthenticated remote attackers can directly access the exposed log file over the network to retrieve the contained information, which may then be leveraged in subsequent cross-site request forgery attacks. The vulnerability carries a CVSS 3.1 score of 5.3 reflecting limited impact confined to confidentiality.

The referenced Wordfence advisory and WordPress plugin source files at Util_Debug.php and Util_Environment.php document the debug logging behavior but provide no additional mitigation details beyond the requirement that the feature remain disabled. The associated EPSS score has remained flat at 0.3984 with no indicated rise after disclosure.

EU & UK References

Vulnerability details

The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in…

more

the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF attacks. Note: the debug feature must be enabled for this to be a concern, and it is disabled by default.

CWE(s)
CWE-200NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Direct remote exploitation of a public-facing WordPress plugin to read sensitive data from an exposed debug log file.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-12365Same product: Boldgrid W3 Total Cache
CVE-2024-13796Shared CWE-200
CVE-2025-25975Shared CWE-200
CVE-2024-12142Shared CWE-200
CVE-2025-25951Shared CWE-200
CVE-2025-15103Shared CWE-200
CVE-2026-34297Shared CWE-200
CVE-2024-26480Shared CWE-200
CVE-2026-24498Shared CWE-200
CVE-2025-22828Shared CWE-200

Affected Assets

boldgrid
w3 total cache
≤ 2.8.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-22 Publicly Accessible Content good match
prevent

Directly controls risks from publicly accessible content by preventing exposure of sensitive information like debug logs containing nonces.

SC-14 Public Access Protections good match
prevent

Provides protections against unauthorized public access to web-exposed resources such as the plugin's debug log file.

CM-7 Least Functionality partial match
prevent

Enforces least functionality by disabling unnecessary features like debug logging, which must be enabled for the exposure to occur.

References