CVE-2024-12849

High

Published: 07 January 2025

Published

07 January 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.9259 99.8th percentile

Risk Priority 71 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-12849 is a high-severity Path Traversal (CWE-22) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to arbitrary file read in all versions through 1.0.1.3. The flaw exists in the unauthenticated wp_ajax_nopriv_elvwp_log_download AJAX handler, which fails to restrict file paths and permits direct retrieval of any readable file on the server. The issue is tracked as CWE-22 and carries a CVSS 3.1 score of 7.5.

Unauthenticated remote attackers can invoke the vulnerable AJAX action to download the contents of arbitrary files, including configuration files, database credentials, or other sensitive data stored on the WordPress host. No authentication or user interaction is required, and successful exploitation yields high-impact confidentiality exposure without affecting integrity or availability.

The referenced Wordfence advisory and WordPress plugin changeset indicate that version 1.0.1.4 addresses the path-handling weakness. The EPSS score has reached a peak of 0.9319 with a current value of 0.9259, indicating sustained exploitation interest following disclosure.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-51150

Vulnerability details

The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_elvwp_log_download AJAX action. This makes it possible for unauthenticated attackers to read the contents…

of arbitrary files on the server, which can contain sensitive information.

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

Why these techniques?

Arbitrary file read via unauthenticated AJAX endpoint in public-facing WordPress plugin directly matches T1190 (Exploit Public-Facing Application) for initial access; resulting ability to retrieve arbitrary server files (configs, etc.) enables T1005 (Data from Local System) collection.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1