CVE-2024-12854
Published: 08 January 2025
Summary
CVE-2024-12854 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The Garden Gnome Package plugin for WordPress is affected by an arbitrary file upload vulnerability in all versions through 2.3.0. The flaw stems from missing file type validation in the code path that automatically extracts uploaded ggpkg files, allowing unauthorized file types to be written to the server. The issue is tracked as CWE-434 and carries a CVSS 3.1 score of 8.8.
Authenticated users with Author privileges or higher can exploit the weakness by uploading a crafted ggpkg archive. Successful exploitation permits arbitrary files, including executable code, to be placed on the web server, which may lead to remote code execution under the web application's context.
A fix has been published in the referenced WordPress plugin changeset that addresses the extraction logic. The Wordfence advisory linked in the CVE record provides additional technical details for defenders.
The EPSS score reached a peak of 0.1514 before settling at 0.1245, indicating moderate and relatively stable post-disclosure interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51155
Vulnerability details
The Garden Gnome Package plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the functionality that automatically extracts 'ggpkg' files that have been uploaded in all versions up to, and including, 2.3.0. This…
more
makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload in public-facing WordPress plugin directly enables exploitation of the web application (T1190) and deployment of a web shell for RCE (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the missing file type validation by requiring comprehensive input validation at file upload points to prevent arbitrary file uploads.
Mandates timely flaw remediation, enabling application of the available patch for the Garden Gnome Package plugin to eliminate the vulnerability.
Enforces least privilege to limit file upload capabilities to only essential roles, mitigating exploitation by authenticated Author-level users.