Security Resilience

CVE-2024-12583

Published
04 January 2025
Modified
15 April 2026
CVSS Score v3.1 9.9
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.014 72th percentile
Risk Priority 78 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-12583 is a critical-severity Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.9 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 28% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

The Dynamics 365 Integration plugin for WordPress is vulnerable to remote code execution and arbitrary file read in all versions through 1.3.23. The issue stems from insufficient input validation and sanitization in the render function, which permits Twig server-side template injection (CWE-1336). The flaw carries a CVSS 3.1 score of 9.9.

Authenticated users with Contributor-level privileges or higher can supply malicious Twig templates that execute arbitrary code or read files on the underlying server. Exploitation requires network access but no user interaction and affects the WordPress site in the context of the web server account.

Public references include a WordPress plugin changeset that addresses the vulnerable code path along with a detailed advisory from Wordfence. The EPSS score has remained flat at 0.1192 with no material increase observed after disclosure.

EU & UK References

Vulnerability Data

The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on…

more

the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

CWE(s)
CWE-1336

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001 Data Obfuscation Command And Control
Adversaries may obfuscate command and control traffic to make it more difficult to detect.
attack.mitre.org →
T1001.001 Junk Data Command And Control
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
attack.mitre.org →
T1003.004 LSA Secrets Credential Access
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.
attack.mitre.org →
T1007 System Service Discovery Discovery
Adversaries may try to gather information about registered local system services.
attack.mitre.org →
T1010 Application Window Discovery Discovery
Adversaries may attempt to get a listing of open application windows.
attack.mitre.org →
T1011.001 Exfiltration Over Bluetooth Exfiltration
Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-5764Shared CWE-1336
CVE-2026-72716Shared CWE-1336
CVE-2026-34587Shared CWE-1336
CVE-2025-26865Shared CWE-1336
CVE-2025-46731Shared CWE-1336
CVE-2026-75650Shared CWE-1336
CVE-2026-92592Shared CWE-1336
CVE-2025-37729Shared CWE-1336
CVE-2025-54287Shared CWE-1336
CVE-2026-72911Shared CWE-1336

Affected Assets

Wordpress
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.3.7
  • V1.3.10

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer testing and static analysis can discover missing neutralization of template directives.

SI-10 Information Input Validation good match

Input validation rejects or sanitizes untrusted data before it reaches the template engine, stopping injection of special syntax.

SA-8 Security and Privacy Engineering Principles partial match

Security engineering principles require use of safe templating APIs and proper escaping of external input.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
blocks

Secure SDLC practices directly require proper input neutralization in template engines to prevent injection.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.14 Information transfer partial match
removes
A.5.15 Access control partial match
removes
A.5.16 Identity management partial match
removes
A.5.17 Authentication information partial match
removes
A.5.18 Access rights partial match
removes
A.8.10 Information deletion partial match
removes

References