CVE-2024-12036: CS Framework Information Disclosure Flaw

CVE-2024-12036 Overview

CVE-2024-12036 is an arbitrary file read vulnerability in the CS Framework plugin for WordPress, affecting all versions up to and including 6.9. The flaw resides in the get_widget_settings_json() function, which fails to properly validate file path inputs. Authenticated attackers with subscriber-level access or higher can read the contents of arbitrary files on the server. These files often contain sensitive information such as WordPress configuration data, database credentials, and authentication secrets. The vulnerability is classified under [CWE-73] (External Control of File Name or Path) and carries network-based exploitability with low complexity requirements.

Critical Impact

Authenticated attackers with minimal privileges can read sensitive server files, including wp-config.php, leading to credential disclosure and potential full site compromise.

Affected Products

• CS Framework plugin for WordPress (all versions ≤ 6.9)
• WordPress themes bundling the CS Framework plugin (including JobCareer)
• WordPress sites with subscriber registration enabled and the plugin active

Discovery Timeline

• 2025-03-07 - CVE-2024-12036 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-12036

Vulnerability Analysis

The vulnerability exists in the get_widget_settings_json() function within the CS Framework plugin. The function accepts a file path parameter from authenticated user input without performing adequate sanitization or path validation. An attacker can supply traversal sequences or absolute file paths to access files outside the intended widget configuration directory.

Because the endpoint requires only subscriber-level authentication, the attack surface includes any WordPress site that permits open user registration. WordPress sites with comment systems, membership features, or WooCommerce typically expose subscriber registration by default.

Root Cause

The root cause is improper external control of a file name or path [CWE-73]. The get_widget_settings_json() function trusts client-supplied input when constructing the file path used in a read operation. There is no allowlist of permitted directories and no normalization to reject path traversal sequences such as ../.

Attack Vector

The attack is conducted over the network via authenticated HTTP requests to the vulnerable AJAX endpoint. An attacker registers or compromises a subscriber account, then issues a crafted request to get_widget_settings_json() with a manipulated file path parameter. The server returns the contents of the targeted file in the JSON response. Common targets include wp-config.php, .htaccess, SSH keys, and system files such as /etc/passwd. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-12036

Indicators of Compromise

• HTTP requests to admin-ajax.php invoking the get_widget_settings_json action from subscriber-level accounts
• Request parameters containing path traversal sequences such as ../, ..\, or URL-encoded variants like %2e%2e%2f
• Anomalous JSON responses from the plugin endpoint containing file contents resembling wp-config.php or system configuration files
• Unexpected new subscriber account registrations followed shortly by AJAX requests to plugin endpoints

Detection Strategies

• Review WordPress access logs for POST requests targeting get_widget_settings_json with suspicious file path parameters
• Deploy a Web Application Firewall (WAF) rule to inspect AJAX action parameters for directory traversal patterns
• Monitor authentication logs for newly created subscriber accounts that immediately interact with plugin AJAX endpoints

Monitoring Recommendations

• Enable verbose logging on the WordPress AJAX subsystem and forward logs to a centralized SIEM for correlation
• Alert on outbound responses from admin-ajax.php exceeding normal payload sizes, which may indicate exfiltrated file contents
• Track read access to wp-config.php and other sensitive files via host-based file integrity monitoring

How to Mitigate CVE-2024-12036

Immediate Actions Required

• Update the CS Framework plugin to a version newer than 6.9 once the vendor publishes a fix
• Disable the plugin if no patched release is available and the site can operate without it
• Disable open user registration in WordPress general settings to limit the pool of potential attackers
• Rotate WordPress database credentials, authentication keys, and salts in wp-config.php if compromise is suspected

Patch Information

No vendor patch has been confirmed in the NVD data as of the last update on 2026-04-15. Site administrators should monitor the Wordfence Vulnerability Report and the ThemeForest plugin page for update announcements.

Workarounds

• Restrict access to admin-ajax.php for unauthenticated and subscriber-level users via WAF rules where feasible
• Apply file system permissions that prevent the web server user from reading sensitive files outside the WordPress document root
• Audit existing subscriber accounts and remove any that are unrecognized or inactive
• Move wp-config.php one directory above the WordPress root, a configuration supported by WordPress, to reduce exposure

# Example WAF rule (ModSecurity) blocking path traversal in the vulnerable action
SecRule ARGS:action "@streq get_widget_settings_json" \
    "chain,id:1012036,phase:2,deny,status:403,msg:'CVE-2024-12036 CS Framework file read attempt'"
    SecRule ARGS "@rx (\.\./|\.\.\\|%2e%2e%2f|wp-config\.php|/etc/passwd)" "t:lowercase,t:urlDecodeUni"