CVE-2024-12314
Published: 18 February 2025
Summary
CVE-2024-12314 is a high-severity Use of Cache Containing Sensitive Information (CWE-524) vulnerability in Megaoptim Rapid Cache. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-12314 is a cache poisoning vulnerability affecting the Rapid Cache plugin for WordPress in all versions up to and including 1.2.3. The issue stems from the plugin storing HTTP headers in cached data without proper sanitization, enabling attackers to inject custom headers into the cache. Published on 2025-02-18, this flaw carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and is linked to CWE-524 and NVD-CWE-Other.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required. By sending crafted HTTP requests containing malicious headers, they can poison the site's cache, causing subsequent visitors to receive responses with unsanitized headers that facilitate cross-site scripting (XSS) attacks. The changed scope (S:C) in the CVSS vector indicates potential impact across security boundaries, with low confidentiality and integrity effects but no availability disruption.
Advisories from Wordfence and the plugin's WordPress.org page provide further details on this vulnerability. Security practitioners should consult these resources—https://www.wordfence.com/threat-intel/vulnerabilities/id/72b777ac-1870-4588-82fe-da96a784ec81?source=cve and https://wordpress.org/plugins/rapid-cache/—for patch information and recommended mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4840
Vulnerability details
The Rapid Cache plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 1.2.3. This is due to plugin storing HTTP headers in the cached data. This makes it possible for unauthenticated attackers to poison…
more
the cache with custom HTTP headers that may be unsanitized which can lead to Cross-Site Scripting.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of a public-facing WordPress plugin vulnerability to achieve cache poisoning and reflected XSS delivery.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation and sanitization of HTTP headers before storage in cache, directly preventing attackers from poisoning the cache with malicious unsanitized headers.
Filters outputs from poisoned cache to neutralize custom headers that enable cross-site scripting in responses served to subsequent users.
Mandates timely remediation of the identified cache poisoning flaw in the Rapid Cache plugin, eliminating the vulnerability across affected versions.