CVE-2024-12152 is a path traversal vulnerability affecting the MIPL WC Multisite Sync plugin for WordPress, which is used to synchronize WooCommerce products, orders, customers, and coupons across multiple sites. The flaw exists in all versions up to and including 1.1.5 and is triggered via the 'mipl_wc_sync_download_log' action. Due to improper validation and limitation of pathname inputs (CWE-22), an unauthenticated attacker can craft requests that traverse directories on the server filesystem, enabling them to read arbitrary files. This can lead to disclosure of sensitive data such as configuration files, credentials, or other critical information stored on the server. The vulnerability is remotely exploitable over the network without any authentication or user interaction, making it highly accessible to attackers. The CVSS v3.1 base score is 7.5, reflecting high impact on confidentiality with no impact on integrity or availability. Although no known exploits have been observed in the wild, the plugin’s role in multisite WooCommerce environments makes it a valuable target for attackers seeking to gather sensitive business or customer data. The absence of official patches at the time of reporting increases the urgency for mitigation.

The primary impact of this vulnerability is unauthorized disclosure of sensitive information stored on the affected server. Attackers can access arbitrary files, potentially exposing database credentials, API keys, customer data, or internal configuration files. This can lead to further compromise, including privilege escalation or lateral movement within the network. Organizations relying on WooCommerce multisite synchronization may face data breaches affecting customer privacy and business operations. The vulnerability does not directly affect data integrity or availability but significantly undermines confidentiality. Given the unauthenticated and network-exploitable nature, the threat surface is broad, increasing risk for organizations worldwide using this plugin. The exposure of sensitive information can also lead to regulatory compliance violations and reputational damage.

Since no official patches are currently available, organizations should immediately implement the following mitigations: 1) Disable or restrict access to the 'mipl_wc_sync_download_log' action endpoint via web server configuration or firewall rules to prevent unauthenticated access. 2) Restrict plugin usage to trusted internal networks or VPNs where possible. 3) Monitor web server logs for suspicious requests attempting directory traversal patterns targeting this action. 4) Apply the principle of least privilege to the web server user to limit file access scope. 5) Consider temporarily disabling the MIPL WC Multisite Sync plugin if synchronization functionality is not critical. 6) Stay alert for official patches or updates from the vendor and apply them promptly once released. 7) Conduct a thorough audit of server files and credentials to detect any prior unauthorized access. These targeted steps go beyond generic advice by focusing on the specific vulnerable functionality and attack vector.