CVE-2024-12152: Arbitrary File Access in MIPL WC Multisite Sync

The Arbitrary File Access vulnerability allows an attacker to bypass intended access controls and read any file the webserver process has access to. This could include configuration files containing database credentials, private keys, or source code. Successful exploitation could lead to complete compromise of the WordPress instance and potentially the underlying server. The attacker could exfiltrate sensitive data, modify website content, or use the compromised server as a launchpad for further attacks against other systems on the network.

1. Reserved2024-12-04
2. Published2025-01-07
3. EPSS updated2026-04-02

The primary mitigation is to upgrade the MIPL WC Multisite Sync plugin to a patched version as soon as it becomes available. Until a patch is released, consider restricting file permissions on the server to limit the potential damage from a successful exploit. Implement a Web Application Firewall (WAF) with rules to block attempts to access files outside of the intended directories. Monitor WordPress logs for suspicious file access attempts, particularly those involving unusual file paths.

Active installs

100Niche

Plugin rating