CVE-2024-12583

CRITICAL LAB

Dynamics 365 Integration plugin - RCE

Title source: llm

Description

The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Exploits (1)

nomisec STUB

by pouriam23 · poc

https://github.com/pouriam23/CVE-2024-12583

View Code ZIP pw:eip

References (3)

[Product] https://plugins.trac.wordpress.org/browser/integration-dynamics/trunk/src/Shortcode/Twig.php#L53

[Product] https://plugins.trac.wordpress.org/changeset/3210927/

[Third Party Advisory] https://www.wordfence.com/threat-intel/vulnerabilities/id/7f3dac5a-9ff8-4e8c-8c73-422123e121d8?source=cve

Scores

CVSS v3 9.9

EPSS 0.0914

EPSS Percentile 92.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Lab Environment

COMMUNITY

Community Lab

docker pull wordpress:latest

https://github.com/pouriam23/CVE-2024-12583

View in Library

Details

CWE

CWE-1336

Status published

Products (1)

alexacrm/Dynamics 365 Integration < 1.3.23

Published Jan 04, 2025

Tracked Since Feb 18, 2026