What is the CVSS score of CVE-2024-12583?

CVE-2024-12583 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 9.1%.

Which versions of Ssti are affected by CVE-2024-12583?

Organizations using Dynamics 365 Integration face critical risk from CVE-2024-12583 rated CVSS 9.9.

How to fix or mitigate CVE-2024-12583?

Within 7 days: Identify all affected systems running for WordPress is vulnerable to Remote Code Execution and Arb and apply vendor patches promptly. Monitor vendor channels for patch availability.

Ssti CVE-2024-12583

CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2025-01-04 security@wordfence.com

RCE Ssti WordPress

9.9

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:01 vuln.today

CVE Published

Jan 04, 2025 - 09:15 nvd

CRITICAL 9.9

DescriptionNVD

The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

AnalysisAI

The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-1336. The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.