CVE-2024-12066
Published: 21 December 2024
Summary
CVE-2024-12066 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 7.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The SMSA Shipping (official) plugin for WordPress is vulnerable to arbitrary file deletion in all versions through 2.3 due to missing file path validation inside the smsa_delete_label function. The flaw, tracked as CWE-73, allows an authenticated user to supply a crafted path that the plugin passes directly to file deletion routines without sanitization or restriction to intended directories.
An attacker with Subscriber-level access or higher can invoke the vulnerable function over the network to remove any file readable by the web server process. Successful deletion of critical files such as wp-config.php can disable the site or enable follow-on remote code execution, producing a CVSS 8.8 impact.
The referenced plugin source shows the vulnerable code present in tag 2.3 and altered in tag 2.4, indicating that updating to version 2.4 or later removes the insufficient path handling. The Wordfence advisory confirms the same root cause and notes that CVE-2024-49249 is likely a duplicate.
EPSS remains near 0.1 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-50569
Vulnerability details
The SMSA Shipping(official) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the smsa_delete_label() function in all versions up to, and including, 2.3. This makes it possible for authenticated attackers, with Subscriber-level access…
more
and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). CVE-2024-49249 is likely a duplicate of this issue.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Rejects externally supplied file or resource identifiers that fail validity checks.