CVE-2024-12036: CS Framework <= 7.1 - Authenticated (Subscriber+) Arbitrary File Read

7.5 CVSS

Description

The CS Framework plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.9 via the get_widget_settings_json() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Classification

CVE ID: CVE-2024-12036

CVSS Base Severity: HIGH

CVSS Base Score: 7.5

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem Types

CWE-73 External Control of File Name or Path

Affected Products

Vendor: Chimpstudio

Product: CS Framework

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.04% (probability of being exploited)

EPSS Percentile: 9.97% (scored less or equal to compared to others)

EPSS Date: 2025-04-05 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2024-12036
https://www.wordfence.com/threat-intel/vulnerabilities/id/5ed1978e-1dd7-45d3-829a-1a75c1789827?source=cve
https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636

Timeline