CVE-2024-12365

High

Published: 14 January 2025

Published

14 January 2025

Modified

16 January 2025

KEV Added

—

Patch

—

CVSS Score 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

EPSS Score 0.1826 95.3th percentile

Risk Priority 28 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-12365 is a high-severity Missing Authorization (CWE-862) vulnerability in Boldgrid W3 Total Cache. Its CVSS base score is 8.5 (High).

Operationally, ranked in the top 4.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Directly enforces the missing capability checks in the plugin's admin functions, preventing unauthorized access by Subscriber-level users to sensitive data and actions.

AC-6 Least Privilege partial match

prevent

Applies least privilege to restrict Subscriber-level accounts from performing admin actions even if authorization checks are bypassed.

AC-4 Information Flow Enforcement partial match

prevent

Enforces controls on information flows to block SSRF requests to arbitrary internal locations, such as cloud instance metadata services.

NVD Description

The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with…

Subscriber-level access and above, to obtain the plugin's nonce value and perform unauthorized actions, resulting in information disclosure, service plan limits consumption as well as making web requests to arbitrary locations originating from the web application that can be used to query information from internal services, including instance metadata on cloud-based applications.

Deeper analysisAI

CVE-2024-12365 affects the W3 Total Cache plugin for WordPress, specifically due to a missing capability check in the is_w3tc_admin_page function across all versions up to and including 2.8.1. This flaw, classified under CWE-862 (Missing Authorization), enables unauthorized data access and has a CVSS v3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), indicating high confidentiality impact with low-privilege network access.

Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability to retrieve the plugin's nonce value, bypassing protections to execute unauthorized actions. Potential impacts include sensitive information disclosure, exhaustion of service plan limits, and SSRF attacks where the web application issues requests to arbitrary external or internal locations, such as querying cloud instance metadata services.

References provided link to vulnerable code locations in the 2.8.0 tag of the plugin repository, including Extension_ImageService_Plugin_Admin.php (line 200), Extensions_Plugin_Admin.php (lines 55 and 246), and Generic_Plugin_Admin.php (lines 385 and 516), highlighting the precise functions lacking proper authorization checks.