CVE-2024-12008: W3 Total Cache <= 2.8.1 Information Exposure via Log Files
The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF attacks. Note: the debug feature must be enabled for this to be a concern, and it is disabled by default.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12008?
CVE-2024-12008 has a moderate severity rating due to the risk of information exposure.
How do I fix CVE-2024-12008?
To fix CVE-2024-12008, update the W3 Total Cache plugin to version 2.8.2 or later.
Who is affected by CVE-2024-12008?
All users of the W3 Total Cache plugin for WordPress versions up to and including 2.8.1 are affected by CVE-2024-12008.
What type of vulnerability is CVE-2024-12008?
CVE-2024-12008 is classified as an Information Exposure vulnerability.
Can unauthenticated users exploit CVE-2024-12008?
Yes, unauthenticated attackers can exploit CVE-2024-12008 to access sensitive information from the debug log file.