CVE-2024-12859
Published: 03 February 2025
Summary
CVE-2024-12859 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Px Lab (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-12859 is a Local File Inclusion (LFI) vulnerability, classified under CWE-98, affecting the BoomBox Theme Extensions plugin for WordPress in all versions up to and including 1.8.0. The flaw exists in the 'boombox_listing' shortcode's 'type' attribute, which fails to properly sanitize user input, allowing the inclusion of arbitrary local files on the server. Published on 2025-02-03, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for confidentiality, integrity, and availability impacts.
Authenticated attackers with contributor-level permissions or higher can exploit this vulnerability remotely without user interaction. By crafting a malicious shortcode, they can include and execute arbitrary files, enabling PHP code execution within those files. This capability allows bypassing access controls, exfiltrating sensitive data, or achieving remote code execution, particularly in environments where PHP file uploads are permitted.
Mitigation guidance is provided in the plugin's official changelog at https://documentation.px-lab.com/boombox/changelog/ and the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/c3a647b6-ed9e-402d-9424-2937f7aa8960?source=cve, which detail patches and remediation steps for affected installations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51159
Vulnerability details
The BoomBox Theme Extensions plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8.0 via the 'boombox_listing' shortcode 'type' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to…
more
include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI in public-facing WordPress plugin directly enables exploitation of the web app (T1190) and PHP code execution via arbitrary file inclusion, facilitating web shell deployment (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the LFI vulnerability by requiring validation and sanitization of user-supplied inputs like the 'boombox_listing' shortcode 'type' attribute to prevent arbitrary file inclusion.
Addresses the specific flaw in the BoomBox Theme Extensions plugin by requiring identification, reporting, and timely remediation through patching as detailed in the official changelog.
Reduces the attack surface by enforcing least privilege, limiting authenticated users with contributor-level or higher permissions who can exploit the vulnerable shortcode.