CVE-2024-12420: WPMobile.App — Android and iOS Mobile Application <= 11.52 - Unauthenticated Arbitrary Shortcode Execution
The The WPMobile.App — Android and iOS Mobile Application plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.52. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12420?
CVE-2024-12420 has a medium severity level due to the risk of arbitrary shortcode execution.
How do I fix CVE-2024-12420?
To fix CVE-2024-12420, update the WPMobile.App plugin to a version higher than 11.52.
What versions are affected by CVE-2024-12420?
CVE-2024-12420 affects all versions of the WPMobile.App plugin up to and including 11.52.
What type of vulnerability is CVE-2024-12420?
CVE-2024-12420 is classified as an arbitrary shortcode execution vulnerability.
Can CVE-2024-12420 be exploited by unauthorized users?
Yes, CVE-2024-12420 can be exploited by unauthorized users due to insufficient validation of user inputs.