CVE-2024-12152
Published: 07 January 2025
Summary
CVE-2024-12152 is a high-severity Path Traversal (CWE-22) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The MIPL WC Multisite Sync plugin for WordPress is vulnerable to directory traversal in all versions through 1.1.5. The flaw exists in the mipl_wc_sync_download_log action and is tracked as CWE-22, allowing an unauthenticated network attacker to supply crafted input that traverses outside intended directories and retrieves the contents of arbitrary server files.
An unauthenticated remote attacker can invoke the vulnerable action directly over HTTP to read sensitive files such as configuration data, credentials, or other restricted content stored on the WordPress host. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflects the absence of authentication or user interaction requirements and the resulting high impact on confidentiality.
Public references include WordPress plugin repository changesets that update the plugin beyond version 1.1.5 and a Wordfence advisory page that documents the issue. The associated EPSS score has remained flat at 0.0769 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-50630
Vulnerability details
The MIPL WC Multisite Sync plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.5 via the 'mipl_wc_sync_download_log' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on…
more
the server, which can contain sensitive information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directory traversal in public-facing WordPress plugin directly enables remote exploitation (T1190) and arbitrary local file read (T1005).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the directory traversal vulnerability by identifying, testing, and applying available patches to the MIPL WC Multisite Sync plugin as documented in changesets 3215735 and 3216574.
Prevents exploitation of the directory traversal in the 'mipl_wc_sync_download_log' action by validating inputs to block malicious path traversal sequences.
Mitigates unauthenticated remote attacks by monitoring and controlling communications at system boundaries to block directory traversal attempts via web application firewall rules.