CVE-2024-12601: Calculated Fields Form DOS Vulnerability

CVE-2024-12601 Overview

CVE-2024-12601 is a Denial of Service (DoS) vulnerability in the Calculated Fields Form plugin for WordPress. The flaw affects all versions up to and including 5.2.63. The plugin's CAPTCHA image generation routine accepts unlimited height and width parameters without validation. Unauthenticated attackers can send repeated requests with oversized values, forcing the server to allocate excessive memory and CPU resources during image rendering. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption).

Critical Impact
Unauthenticated remote attackers can degrade server availability by issuing crafted CAPTCHA requests with large dimension parameters, consuming memory and processor time.

Affected Products

Codepeople Calculated Fields Form plugin for WordPress, all versions through 5.2.63
WordPress sites running the vulnerable plugin with CAPTCHA fields enabled
Shared hosting environments without resource throttling or rate limiting

Discovery Timeline

2024-12-17 - CVE-2024-12601 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12601

Vulnerability Analysis

The Calculated Fields Form plugin generates CAPTCHA images using user-supplied height and width parameters. The plugin's CAPTCHA handler, located in captcha/captcha.php, passes these parameters directly to the image creation functions without enforcing upper bounds. An attacker who requests a CAPTCHA image with dimensions such as width=100000&height=100000 forces PHP's GD library to allocate a buffer sized proportional to the product of those values. Each request consumes memory, CPU cycles, and worker processes on the web server.

Repeating this request pattern from a single source or distributed botnet exhausts available PHP workers. Legitimate users then experience slow responses or complete service unavailability. The attack requires no authentication and no user interaction.

Root Cause

The root cause is missing input validation on numeric parameters supplied to a resource-intensive operation. The vulnerable code paths at lines 74 and 75 of captcha.php accept arbitrary integers as image dimensions. Without upper bounds, maximum-size caps, or rate limiting, the server performs expensive work on behalf of unauthenticated clients. This is a textbook Uncontrolled Resource Consumption flaw.

Attack Vector

The attack vector is network-based through standard HTTP(S) requests to the WordPress site hosting a form that uses the plugin's CAPTCHA feature. An attacker enumerates CAPTCHA endpoints exposed by the plugin, then submits GET or POST requests with inflated height and width values. See the Wordfence Vulnerability Analysis for technical references and the WordPress Plugin Captcha Code for the vulnerable lines.

No public proof-of-concept exploit code is referenced in the advisory. Readers should consult the vendor sources rather than synthesized examples.

Detection Methods for CVE-2024-12601

Indicators of Compromise

HTTP request logs showing repeated calls to the plugin's CAPTCHA endpoint with abnormally large width or height query parameters.
Sudden spikes in PHP-FPM worker usage, memory allocation errors, or Allowed memory size exhausted entries in PHP error logs.
Elevated response latency or HTTP 5xx error rates correlated with traffic to WordPress forms containing Calculated Fields Form CAPTCHAs.

Detection Strategies

Inspect web server access logs for requests matching the CAPTCHA path pattern with numeric parameters exceeding sane thresholds, for example values greater than 1000 pixels.
Deploy a Web Application Firewall (WAF) rule that flags or blocks CAPTCHA requests where width or height exceed defined limits.
Correlate PHP worker exhaustion events in application performance monitoring tools with upstream HTTP request patterns.

Monitoring Recommendations

Track per-source-IP request rates to WordPress form endpoints and alert on anomalous bursts from unauthenticated clients.
Monitor CPU, memory, and PHP worker pool metrics on WordPress hosts to detect resource saturation early.
Enable the WordPress plugin's version inventory in asset management to identify every site running Calculated Fields Form at or below 5.2.63.

How to Mitigate CVE-2024-12601

Immediate Actions Required

Update the Calculated Fields Form plugin to the version released after 5.2.63 that applies WordPress Changeset 3207826.
Audit all WordPress sites in the environment to identify installations of the plugin and prioritize patching sites with public-facing forms.
Enable rate limiting at the WAF, reverse proxy, or CDN layer for requests targeting form and CAPTCHA endpoints.

Patch Information

The vendor addressed the vulnerability in WordPress Changeset 3207826, which enforces bounds on the CAPTCHA height and width parameters. Administrators should update through the WordPress plugin dashboard or by replacing plugin files with the patched release. Confirm the installed version exceeds 5.2.63 after update.

Workarounds

Temporarily disable the Calculated Fields Form plugin on sites that cannot be patched immediately, especially those with public forms.
Add WAF rules that reject requests to the plugin's CAPTCHA handler when width or height exceed a safe maximum such as 500 pixels.
Configure PHP memory_limit and web server worker timeouts conservatively to contain the impact of individual malicious requests.

bash

# Example ModSecurity rule to cap CAPTCHA dimensions
SecRule ARGS:width "@gt 500" \
    "id:1012601,phase:2,deny,status:400,msg:'CFF CAPTCHA width exceeds limit'"
SecRule ARGS:height "@gt 500" \
    "id:1012602,phase:2,deny,status:400,msg:'CFF CAPTCHA height exceeds limit'"