CVE-2024-12638
Published: 30 January 2025
Summary
CVE-2024-12638 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Ombu Bulk Me Now\!. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2024-12638 is a reflected cross-site scripting (XSS) vulnerability in the Bulk Me Now! WordPress plugin through version 2.0. The plugin does not sanitize and escape a parameter before outputting it back in the page, enabling attackers to inject malicious scripts. It carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and maps to CWE-79.
Attackers require no privileges and can exploit this remotely over the network with low complexity by crafting a malicious payload in the vulnerable parameter. Exploitation relies on user interaction, such as an administrator clicking a malicious link, which reflects the payload and executes JavaScript in the high-privilege user's browser context. This can lead to low-impact confidentiality, integrity, and availability effects, including potential session theft or unauthorized actions within the victim's scope due to the changed security scope.
The WPScan advisory at https://wpscan.com/vulnerability/a6f5b0fe-00a0-4e30-aec6-87882c035beb/ provides further details on the vulnerability, including recommended mitigations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51015
Vulnerability details
The Bulk Me Now! WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables remote exploitation of a web application via crafted malicious links/parameters, matching T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates reflected XSS by requiring output filtering and escaping of unsanitized parameters before page rendering.
Addresses the core issue by enforcing input validation and sanitization of the vulnerable parameter to block malicious script injection.
Ensures timely flaw remediation through patching the Bulk Me Now! plugin vulnerability before exploitation by high-privilege users.