CVE-2024-12034
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-12034 is a medium-severity Generation of Predictable Numbers or Identifiers (CWE-340) vulnerability in Wordpress (inferred from references). Its CVSS base score is 5.3 (Medium).
Operationally, ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-50549
Vulnerability Data
The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to IP unblocking in all versions up to, and including, 1.25. This is due to the plugin not utilizing a strong unique key when generating an unblock request. This makes it…
more
possible for unauthenticated attackers to unblock their IP after being locked out due to too many bad password attempts
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover predictable number generation through targeted analysis or fuzzing of identifier creation routines.
Cryptographic key establishment and management mandates proper entropy and randomness during generation, directly stopping predictable identifiers at the source.
Authenticator management requires secure initial distribution and handling of authenticators, structurally preventing predictable values from being usable.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Cryptographic controls require use of approved, sufficiently random algorithms and key-generation methods, directly mitigating predictable number/identifier weaknesses.
A secure SDLC incorporates threat modelling and secure-design reviews that flag predictable identifier generation early in the lifecycle.
Secure-coding standards explicitly forbid predictable random functions and mandate cryptographically secure RNGs, preventing the weakness at the source.
Security testing in development can detect predictable identifiers through static/dynamic analysis and fuzzing, reducing residual risk.
A.8.5 chooses and strengthens authentication techniques and log-on procedures to substantiate claimed identities; it has no bearing on generation of predictable numbers/identifiers or stopping their exploitation
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.