CVE-2025-24580: WordPress 12 Step Meeting List plugin <= 3.16.5 - Arbitrary Content Deletion vulnerability
First published: Fri Jan 24 2025(Updated: )
Missing Authorization vulnerability in Code for Recovery 12 Step Meeting List allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects 12 Step Meeting List: from n/a through 3.16.5.
Credit: audit@patchstack.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress 12 Step Meeting List | <=3.16.5 | |
| WordPress 12 Step Meeting List plugin | <=3.16.5 |
Remedy
Update the WordPress 12 Step Meeting List wordpress plugin to the latest available version (at least 3.16.6).
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-24580?
CVE-2025-24580 is classified as a serious vulnerability due to its potential for unauthorized access through improperly configured access control settings.
How do I fix CVE-2025-24580?
To mitigate CVE-2025-24580, ensure that proper access control configurations are implemented in the Code for Recovery 12 Step Meeting List plugin, especially if you are using versions up to 3.16.5.
What versions are affected by CVE-2025-24580?
CVE-2025-24580 affects all versions of the Code for Recovery 12 Step Meeting List plugin from n/a through 3.16.5.
How does CVE-2025-24580 impact the 12 Step Meeting List plugin?
The vulnerability in CVE-2025-24580 allows attackers to exploit missing authorization checks, potentially leading to unauthorized access to sensitive data.
What can an attacker do if they exploit CVE-2025-24580?
An attacker exploiting CVE-2025-24580 may gain unauthorized access to meet configuration settings and manipulate data within the 12 Step Meeting List.
- agent/title
- agent/weakness
- agent/remedy
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- agent/event
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/code for recovery
- canonical/wordpress 12 step meeting list
- vendor/wordpress
- canonical/wordpress 12 step meeting list plugin