CVE-2025-24582
Published: 24 January 2025
Summary
CVE-2025-24582 is a medium-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-22 (Publicly Accessible Content) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely remediation of the known flaw in the 12-step-meeting-list WordPress plugin up to version 3.16.5 directly prevents exploitation of this sensitive data exposure vulnerability.
Filtering information in outputs prior to transmission prevents the insertion and unauthorized retrieval of embedded sensitive data by unauthenticated attackers.
Reviewing and restricting publicly accessible content from the WordPress plugin ensures no sensitive information is exposed in responses sent to unauthenticated users.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an information disclosure flaw in a publicly accessible WordPress plugin, directly enabling exploitation via T1190 (Exploit Public-Facing Application) to retrieve embedded sensitive data over the network.
NVD Description
Insertion of Sensitive Information Into Sent Data vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Retrieve Embedded Sensitive Data.This issue affects 12 Step Meeting List: from n/a through <= 3.16.5.
Deeper analysisAI
CVE-2025-24582 is an Insertion of Sensitive Information Into Sent Data vulnerability (CWE-201) in the WordPress plugin AA Web Servant 12 Step Meeting List, also referred to as 12-step-meeting-list. The issue affects all versions of the plugin from n/a through 3.16.5, enabling attackers to retrieve embedded sensitive data.
With a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), the vulnerability can be exploited by unauthenticated attackers over the network with low attack complexity and no user interaction required. Successful exploitation allows retrieval of embedded sensitive data, resulting in a low-impact confidentiality violation.
Patchstack provides details on this sensitive data exposure vulnerability in the WordPress 12-step-meeting-list plugin version 3.16.5. For mitigation guidance and patch information, refer to the advisory at https://patchstack.com/database/Wordpress/Plugin/12-step-meeting-list/vulnerability/wordpress-12-step-meeting-list-plugin-3-16-5-sensitive-data-exposure-vulnerability?_s_id=cve.
Details
- CWE(s)