PT-2025-1763 · WordPress · Mipl Wc Multisite Sync

Nvthien + 1 · Published 2025-01-07 · Updated 2025-01-07 · CVE-2024-12152

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MIPL WC Multisite Sync plugin for WordPress versions up to, and including, 1.1.5

Description The issue allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information, through the mipl wc sync download log action. This enables access to confidential data.

Recommendations For versions up to, and including, 1.1.5, update to a version later than 1.1.5 to resolve the issue. As a temporary workaround, consider disabling the mipl wc sync download log action until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-12152

Affected Products

Mipl Wc Multisite Sync

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-12152 · Security Note
• https://t.me/cvenotify/106541 · Telegram Post
• https://twitter.com/CVEnew/status/1876565002859192518 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3216574%40mipl-wc-multisite-sync&new=3216574%40mipl-wc-multisite-sync&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/575d1e24-d23d-4589-bb71-f52efec1ac58?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3215735%40mipl-wc-multisite-sync&new=3215735%40mipl-wc-multisite-sync&sfp_email=&sfph_mail= · Note
• https://t.me/cvedetector/14507 · Telegram Post