CVE-2024-0212 HIGH

CVE-2024-0212: Cloudflare WordPress plugin enables information disclosure of Cloudflare API (for low privileged users)

Vendor Cloudflare

Product Cloudflare-WordPress

Weakness CWE-284

Published January 29, 2024

Last update June 6, 2025

View on NVD All CVEs

CVSS base score

8.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to access data from the Cloudflare API.

Explanation of Vulnerability in Simple Terms

02Summary

The Cloudflare WordPress plugin versions 4.12.2 and earlier contain an access control flaw that allows authenticated users with low privileges to read and modify sensitive data they should not have access to. An attacker with a basic user account can exploit this without additional user interaction. The vulnerability affects the plugin's permission checks across multiple functions.

What an attacker can do

03Attacker Capabilities

Read and modify sensitive data belonging to other users or the site.

Potential impact on your site

04Site Impact

Unauthorized users can access and alter private content, user data, or site settings depending on plugin functionality.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).

Key dates

06Disclosure timeline

January 29, 2024 CVE published

June 6, 2025 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-0212 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/284.html AskarLabs — CWE-284 write-up Improper Access Control

Related vulnerabilities