CVE-2024-12365

HIGH

W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-12365 has a selected CVSS score of 8.5 (high); EIP currently links 1 repository PoC.

Description

The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain the plugin's nonce value and perform unauthorized actions, resulting in information disclosure, service plan limits consumption as well as making web requests to arbitrary locations originating from the web application that can be used to query information from internal services, including instance metadata on cloud-based applications.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 14, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

W3 Total Cache

Browse boldgrid / W3 Total Cache

Default status: unaffected

CVE ListThrough 2.8.1affected

Proofs of concept

1

Repository PoCs

GitHubspyata123/W3TotalChacheRepository PoCby spyata1230Not analyzed1 file

3.3 KiB · linked to 2 vulnerabilities

GitHub
PoC details

References

11