CVE-2024-12415

Medium

Published: 31 January 2025

Published

31 January 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Score 0.0104 77.9th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-12415 is a medium-severity Code Injection (CWE-94) vulnerability in Wordpress (inferred from references). Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 22.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Other Platforms; in the Supply Chain and Deployment risk domain.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-50838

Vulnerability details

The The AI Infographic Maker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.9.0. This is due to the software allowing users to execute an action that does not properly validate a…

value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

CWE(s): CWE-94

AI Security AnalysisAI

AI Category: Other Platforms
Risk Domain: Supply Chain and Deployment
OWASP Top 10 for LLMs 2025: None mapped
Classification Reason: Matched keywords: ai

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability enables unauthenticated arbitrary shortcode execution in a WordPress plugin, facilitating exploitation of a public-facing web application for remote code execution.

Affected Assets

Wordpress

—

inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-34 Non-modifiable Executable Programs

addresses: CWE-94

Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.

SC-44 Detonation Chambers

addresses: CWE-94

Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.

SI-10 Information Input Validation

addresses: CWE-94

Validates inputs used in dynamic code generation to block injected directives.

SI-16 Memory Protection

addresses: CWE-94

Directly prevents execution of attacker-supplied code written into data memory regions.