CVE-2024-12365

Summary

CVE-2024-12365 is a vulnerability affecting the W3 Total Cache plugin for WordPress. In versions up to 2.8.1, there is a missing capability check on the is_w3tc_admin_page function. This issue allows authenticated attackers with Subscriber-level access or higher to obtain the plugin's nonce value and perform unauthorized actions. Consequences of exploiting this vulnerability include information disclosure, excessive service plan limit consumption, and making web requests to arbitrary locations, potentially revealing internal instance metadata for cloud-based applications.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.