CVE-2024-12571
Published: 20 December 2024
Summary
CVE-2024-12571 is a critical-severity PHP Remote File Inclusion (CWE-98) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 6.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Store Locator for WordPress with Google Maps – LotsOfLocales plugin for WordPress version 3.98.9 contains a local file inclusion vulnerability in the sl_engine parameter. The flaw, tracked as CVE-2024-12571 and assigned CWE-98, permits inclusion and execution of arbitrary server-side files, which can lead to PHP code execution when combined with file upload capabilities.
Unauthenticated attackers can exploit the issue over the network without any user interaction or credentials. Successful exploitation allows bypass of access controls, disclosure of sensitive data, or full code execution on the affected WordPress site, consistent with the CVSS 9.8 rating.
The EPSS score rose from a low baseline to a peak of 0.2042 before settling at the current value of 0.1237, indicating emerging exploitation interest after public disclosure. References to the vulnerable code path and Wordfence analysis are available but do not detail specific patches or mitigation steps in the provided data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-50967
Vulnerability details
The Store Locator for WordPress with Google Maps – LotsOfLocales plugin for WordPress is vulnerable to Local File Inclusion in version 3.98.9 via the 'sl_engine' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on…
more
the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.