CVE-2024-12420 Overview
CVE-2024-12420 affects the WPMobile.App — Android and iOS Mobile Application plugin for WordPress. The plugin permits arbitrary shortcode execution in all versions up to and including 11.52. The flaw exists because the plugin passes untrusted user input to do_shortcode without proper validation. Unauthenticated attackers can invoke arbitrary WordPress shortcodes over the network. The issue is classified under CWE-94: Improper Control of Generation of Code.
Critical Impact
Unauthenticated attackers can execute arbitrary shortcodes on affected WordPress sites, potentially exposing restricted content, triggering privileged plugin functionality, or leaking sensitive data.
Affected Products
- WPMobile.App — Android and iOS Mobile Application plugin for WordPress, versions up to and including 11.52
- WordPress installations with the vulnerable plugin activated
- Any mobile application backend relying on the plugin's shortcode rendering endpoints
Discovery Timeline
- 2024-12-13 - CVE-2024-12420 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12420
Vulnerability Analysis
The WPMobile.App plugin exposes an action handler that forwards user-controlled input to WordPress's do_shortcode function. Because the plugin does not validate or restrict the shortcode value, an unauthenticated attacker can supply any registered shortcode for execution. WordPress shortcodes commonly render dynamic content, query the database, or invoke plugin-specific logic. Attackers can therefore reach functionality intended for authenticated contexts or extract data that is otherwise gated by access controls. The weakness maps to CWE-94: Improper Control of Generation of Code.
Root Cause
The root cause is missing input validation on a value passed to do_shortcode. The plugin treats the incoming parameter as trusted and does not restrict it to an allowlist of safe shortcodes or verify the caller's authorization. Any shortcode registered on the site becomes callable through the vulnerable action.
Attack Vector
Exploitation requires no authentication and no user interaction. An attacker sends a crafted HTTP request to the plugin's action endpoint with a shortcode payload in the vulnerable parameter. The server evaluates the shortcode and returns or acts on the rendered output. Impact depends on which shortcodes are registered on the target site, including those provided by other installed plugins. See the Wordfence Vulnerability Report and the WordPress Plugins Changeset for technical details.
No verified public exploit code is available. The vulnerability mechanism reduces to an unauthenticated HTTP request whose parameter is concatenated into a do_shortcode call server-side.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2024-12420
Indicators of Compromise
- Unauthenticated HTTP POST or GET requests to WPMobile.App plugin action endpoints containing raw [shortcode] syntax in parameter values.
- Access log entries showing repeated calls to the plugin's AJAX or REST actions from a single external IP address.
- Unexpected output of shortcode-generated content (user lists, form submissions, gated posts) in HTTP responses to unauthenticated clients.
Detection Strategies
- Inspect web server logs for request parameters containing bracketed shortcode syntax targeting WPMobile.App endpoints.
- Deploy WAF rules that flag requests to the plugin's handlers when parameters contain [ and ] characters or known shortcode names.
- Correlate anomalous outbound content sizes from wp-admin/admin-ajax.php requests against baselines for the affected sites.
Monitoring Recommendations
- Enable verbose access logging on WordPress hosts and forward logs to a centralized SIEM for retention and query.
- Monitor plugin version inventory across managed WordPress instances and alert on installations of WPMobile.App at or below version 11.52.
- Track error and PHP execution logs for unexpected shortcode-related warnings that indicate exploitation attempts.
How to Mitigate CVE-2024-12420
Immediate Actions Required
- Update the WPMobile.App plugin to a version above 11.52 as soon as the vendor publishes a fixed release.
- Disable and remove the plugin on sites where the mobile application feature is not in active use.
- Restrict access to WordPress AJAX and REST endpoints from untrusted networks where feasible.
Patch Information
Refer to the WordPress Plugins Changeset for the vendor's code changes addressing this issue. The Wordfence Vulnerability Report provides advisory context and remediation guidance.
Workarounds
- Deploy a web application firewall rule that blocks unauthenticated requests to WPMobile.App action handlers containing shortcode syntax in parameters.
- Temporarily deactivate the plugin until a patched version is installed and validated.
- Audit installed plugins and remove or restrict shortcodes that expose sensitive data or privileged actions.
# Example WAF rule (ModSecurity) blocking shortcode payloads to the plugin endpoint
SecRule REQUEST_URI "@contains admin-ajax.php" \
"chain,phase:2,deny,status:403,id:1024120,msg:'CVE-2024-12420 WPMobile.App shortcode injection attempt'"
SecRule ARGS "@rx \[[a-zA-Z0-9_\-]+" "t:none"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
