WordPress Plugin Vulnerabilities

Dynamics 365 Integration < 1.3.24 - Contributor+ RCE and Arbitrary File Read

Description

The plugin is vulnerable to Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Affects Plugins

Plugin icon
integration-dynamics
Fixed in 1.3.24

References

CVE
CVE-2024-12583
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/7f3dac5a-9ff8-4e8c-8c73-422123e121d8

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
9.9 (critical)

Miscellaneous

Original Researcher
Peter Thaleikis
Verified
No
WPVDB ID
e4a3fbc6-ba12-4a06-a9a7-6055832067ab

Timeline

Publicly Published
2025-01-03 (about 1 year ago)
Added
2025-01-13 (about 1 year ago)
Last Updated
2025-01-13 (about 1 year ago)

Other

Published
Title
Published
2025-01-06
Title
SEO LAT Auto Post <= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution)
Published
2024-05-13
Title
Simple Basic Contact Form < 20240511 - Unauthenticated Arbitrary Shortcode Execution
Published
2025-10-24
Title
Discussion Board – WordPress Forum Plugin < 2.5.6 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
Published
2025-08-02
Title
Doctreat < 1.6.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
Published
2026-05-12
Title
Advanced Custom Fields: Extended < 0.9.2.4 - Unauthenticated Arbitrary Shortcode Execution