PT-2025-10055 · WordPress · Cs Framework

Tonn · Published 2025-03-07 · Updated 2025-03-08 · CVE-2024-12036

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CS Framework plugin for WordPress versions prior to 6.9

Description The issue allows authenticated attackers with subscriber-level access and above to read the contents of arbitrary files on the server, potentially containing sensitive information, via the get widget settings json() function.

Recommendations For versions prior to 6.9, update to a version that includes a fix for this issue to prevent arbitrary file read. As a temporary workaround, consider restricting access to the get widget settings json() function until a patch is available.

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2024-12036

Affected Products

Cs Framework

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-12036 · Security Note
• https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636 · Note
• https://t.me/cvenotify/113798 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/5ed1978e-1dd7-45d3-829a-1a75c1789827?source=cve · Note
• https://twitter.com/CVEnew/status/1898246399508058597 · Twitter Post
• https://twitter.com/cybercronai/status/1897996304380198940 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1898050719359320475 · Twitter Post