PT-2025-1899 · Microsoft · Dynamics 365 Integration Plugin For Wordpress

Peter Thaleikis · Published 2025-01-04 · Updated 2025-01-04 · CVE-2024-12583

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dynamics 365 Integration plugin for WordPress version 1.3.23 and earlier

Description The issue is related to Remote Code Execution and Arbitrary File Read due to missing input validation and sanitization on the render function, allowing authenticated attackers with Contributor-level access and above to execute code on the server via Twig Server-Side Template Injection.

Recommendations For versions up to and including 1.3.23, update to a version later than 1.3.23 to resolve the issue. As a temporary workaround, consider restricting access to the render function until a patch is available. Restrict Contributor-level access and above to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2024-12583

Affected Products

Dynamics 365 Integration Plugin For Wordpress

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-12583 · Security Note
• https://twitter.com/VulmonFeeds/status/1875481428340662539 · Twitter Post
• https://plugins.trac.wordpress.org/browser/integration-dynamics/trunk/src/Shortcode/Twig.php#L53 · Note
• https://t.me/cvedetector/14270 · Telegram Post
• https://twitter.com/CveFindCom/status/1875459909107511476 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3210927 · Note
• https://twitter.com/CVEnew/status/1875465275849703784 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7f3dac5a-9ff8-4e8c-8c73-422123e121d8?source=cve · Note
• https://twitter.com/WhalersLtd/status/1875488161368842251 · Twitter Post
• https://t.me/cvenotify/106309 · Telegram Post