Plattform
wordpress
Komponente
cs-framework
Behoben in
7.0.1
CVE-2024-12035 describes an arbitrary file access vulnerability discovered in the CS Framework plugin for WordPress. This flaw allows authenticated attackers, even those with Subscriber-level access, to delete files on the server. The vulnerability exists in versions up to and including 6.9 and can be exploited to achieve remote code execution, particularly if critical configuration files like wp-config.php are targeted.
The primary impact of CVE-2024-12035 is the potential for remote code execution (RCE). While the vulnerability requires authentication, the relatively low access level (Subscriber) needed to exploit it significantly broadens the attack surface. An attacker could delete critical WordPress files, disrupting the website's functionality and potentially gaining control of the server. Deleting wp-config.php, for example, would effectively disable the WordPress installation, and further exploitation could be possible depending on the server's configuration and other installed plugins. The ability to delete arbitrary files represents a severe compromise of system integrity.
CVE-2024-12035 was publicly disclosed on 2025-03-07. As of this date, no public proof-of-concept (PoC) code has been released, but the vulnerability's ease of exploitation suggests that a PoC is likely to emerge. The vulnerability has not been added to the CISA KEV catalog. Active exploitation is currently unconfirmed, but the high CVSS score and the relatively simple attack vector warrant close monitoring.
Exploit-Status
EPSS
1.66% (82% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation for CVE-2024-12035 is to upgrade the CS Framework plugin to a version that addresses the vulnerability. The vendor has not yet released a fixed version, so users should monitor the WordPress plugin repository for updates. As a temporary workaround, restrict file upload permissions and implement stricter access controls for WordPress users with Subscriber roles. Consider using a WordPress security plugin with file integrity monitoring capabilities to detect unauthorized file modifications. After upgrading, verify the plugin's functionality and ensure no unexpected errors occur.
Actualice el plugin CS Framework a una versión posterior a la 7.0. Esto solucionará la vulnerabilidad de eliminación arbitraria de archivos. Si no hay una versión disponible, considere deshabilitar el plugin hasta que se publique una actualización.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
It's an arbitrary file deletion vulnerability in the CS Framework WordPress plugin, allowing authenticated users to delete files on the server, potentially leading to remote code execution.
If you're using the CS Framework plugin in WordPress and are running a version 6.9 or earlier, you are potentially affected by this vulnerability.
Upgrade the CS Framework plugin to the latest available version to patch the vulnerability. If immediate upgrade isn't possible, implement temporary mitigation measures like WAF rules.
While not currently listed on KEV or EPSS, the ease of exploitation suggests a potential for active exploitation, so vigilance is advised.
Refer to the official WordPress plugin repository for updates and security advisories related to the CS Framework plugin and the CVE-2024-12035 vulnerability.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.