CVE-2024-12008

CVE-2024-12008 is an information exposure vulnerability (CWE-200) in the W3 Total Cache plugin for WordPress, affecting all versions up to and including 2.8.1. The issue stems from a publicly exposed debug log file that allows unauthorized access to potentially sensitive information logged within it. The vulnerability has a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), rated as medium severity, and was published on 2025-01-14.

Unauthenticated attackers with network access can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation enables reading low-impact confidential data from the exposed log file, such as nonce values that could be leveraged in subsequent CSRF attacks. Notably, the debug feature must be enabled for the log file to be exposed and relevant, and it is disabled by default.

Advisories reference specific code locations in the plugin, including Util_Debug.php at line 29 and Util_Environment.php at line 430 in version 2.8.0, as well as a Wordfence threat intelligence report detailing the issue. Mitigation relies on ensuring the debug feature remains disabled, with practitioners advised to review and update the plugin to versions beyond 2.8.1 where available to address the exposure.