CVE-2024-12432 describes a vulnerability in the WPC Shop as a Customer for WooCommerce plugin for WordPress, where the 'generate_key' function fails to produce sufficiently random values. This weakness enables authenticated attackers with Subscriber-level privileges or above to leverage the ajax_login() function to generate a unique but predictable key, allowing them to log in as site administrators. The issue affects all versions up to and including 1.2.8 and is categorized as CWE-330 (Use of Insufficiently Random Values). The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no user interaction.

An attacker with at least Subscriber-level access can exploit this vulnerability to escalate privileges and take over administrator accounts on affected WordPress sites using the vulnerable plugin. This compromises site confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor for suspicious login activity related to the ajax_login() function. Avoid using the vulnerable plugin version and consider disabling it if possible.