Denial of Service Vulnerability in Calculated Fields Form Plugin for WordPress

CVE-2024-12601

What is CVE-2024-12601?

The Calculated Fields Form plugin for WordPress is exposed to a significant Denial of Service (DoS) vulnerability across all versions up to and including 5.2.63. This vulnerability arises from the plugin's implementation of CAPTCHA images, which allows for unlimited height and width parameters. As a result, unauthenticated attackers can exploit this by sending numerous requests with excessively large values, which may overwhelm server resources if not properly mitigated. This situation can lead to a degradation of service or complete unavailability of the affected website.

References