Cyber Posture

CVE-2024-12563

High

Published: 18 March 2025

Published
18 March 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0007 21.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

Security Summary

CVE-2024-12563 is a Local File Inclusion vulnerability (CWE-98) in the s2Member Pro plugin for WordPress, affecting all versions up to and including 250214. The flaw exists in the handling of the 'template' attribute, which allows improper inclusion of local files. It has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.

Authenticated attackers with contributor-level permissions or higher can exploit this vulnerability over the network with low complexity and no user interaction required. By manipulating the 'template' attribute, they can include and execute arbitrary files on the server, leading to PHP code execution. This enables bypassing access controls, obtaining sensitive data, or achieving full remote code execution.

Mitigation details are available in the official s2Member changelog at https://s2member.com/changelog/ and the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d3326e9d-504f-444f-baf7-03989594f483?source=cve.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

LFI vuln in public-facing WordPress plugin enables exploitation of public-facing apps (T1190), local file reads for sensitive data (T1005), and PHP code execution for RCE via web shells (T1100).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References