Information Exposure Vulnerability in W3 Total Cache Plugin by WordPress

CVE-2024-12008

Summary

The W3 Total Cache plugin for WordPress exposes sensitive information through its debug log file in versions up to and including 2.8.1. When the debug feature is enabled, which is not the default setting, attackers can access potentially critical data like nonce values, which may facilitate further Cross-Site Request Forgery (CSRF) attacks. Website administrators should ensure that the debug feature remains disabled to prevent unauthorized access to sensitive information.

References