CVE-2024-12152 is a directory traversal vulnerability in the MIPL WC Multisite Sync WordPress plugin (version ≤ 1.1.5). It allows unauthenticated attackers to exploit the 'mipl_wc_sync_download_log' action to read arbitrary files on the server. This improper limitation of pathname to a restricted directory (CWE-22) can lead to disclosure of sensitive server files. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with network attack vector, no privileges required, and no user interaction needed.

Successful exploitation enables unauthenticated attackers to read arbitrary files on the affected server, potentially exposing sensitive information such as configuration files, credentials, or other private data. This can lead to further attacks or compromise of the system confidentiality. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting access to the vulnerable plugin functionality, especially the 'mipl_wc_sync_download_log' action, to prevent exploitation. Monitor official vendor channels for updates and apply patches promptly once available.