CVE-2024-12036
Published: 07 March 2025
Summary
CVE-2024-12036 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Themeforest (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 39.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-12036 is an arbitrary file read vulnerability in the CS Framework plugin for WordPress, affecting all versions up to and including 6.9. The issue stems from the get_widget_settings_json() function, which allows attackers to access the contents of arbitrary files on the server. It has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-73 (External Control of File Name or Path). The vulnerability was published on 2025-03-07.
Authenticated attackers with subscriber-level access or higher can exploit this vulnerability remotely over the network with low complexity. By leveraging the flawed function, they can read sensitive files on the server, potentially exposing configuration data, credentials, or other confidential information without impacting integrity or availability.
Advisories from Wordfence (https://www.wordfence.com/threat-intel/vulnerabilities/id/5ed1978e-1dd7-45d3-829a-1a75c1789827?source=cve) and the JobCareer theme page on ThemeForest (https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636), which integrates the CS Framework, provide additional details on the issue. Security practitioners should review these for patch availability and mitigation guidance, such as updating the plugin or restricting subscriber access.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54142
Vulnerability details
The CS Framework plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.9 via the get_widget_settings_json() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents…
more
of arbitrary files on the server, which can contain sensitive information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The arbitrary file read vulnerability directly enables collection of data from the local system (T1005) and specifically facilitates access to unsecured credentials stored in files such as configuration files (T1552.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Remediating the flaw in the CS Framework plugin's get_widget_settings_json() function directly prevents arbitrary file reads by applying patches available post-version 6.9.
Validating inputs to the get_widget_settings_json() function prevents external control of file paths (CWE-73), blocking path traversal for arbitrary file reads.
Enforcing access controls ensures authenticated subscriber-level users cannot bypass restrictions to read arbitrary sensitive files on the server.