CVE-2024-12601: CWE-400 Uncontrolled Resource Consumption in codepeople Calculated Fields Form
The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. This is due to unlimited height and width parameters for CAPTCHA images. This makes it possible for unauthenticated attackers to send multiple requests with large values, resulting in slowing server resources if the server does not mitigate Denial of Service attacks.
AI Analysis
Technical Summary
CVE-2024-12601 is a medium severity vulnerability in the codepeople Calculated Fields Form WordPress plugin. It arises from uncontrolled resource consumption (CWE-400) due to unlimited height and width parameters for CAPTCHA images. Attackers can send multiple requests with large parameter values without authentication, potentially causing Denial of Service by exhausting server resources. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low complexity, no privileges or user interaction required, and impact limited to availability loss.
Potential Impact
Successful exploitation results in Denial of Service by slowing or disrupting server availability due to resource exhaustion. There is no impact on confidentiality or integrity. The vulnerability can be triggered remotely by unauthenticated attackers.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing server-level protections such as rate limiting or CAPTCHA parameter validation to mitigate potential abuse. Monitor for unusual traffic patterns targeting CAPTCHA parameters.
CVE-2024-12601: CWE-400 Uncontrolled Resource Consumption in codepeople Calculated Fields Form
Description
The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. This is due to unlimited height and width parameters for CAPTCHA images. This makes it possible for unauthenticated attackers to send multiple requests with large values, resulting in slowing server resources if the server does not mitigate Denial of Service attacks.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-12601 is a medium severity vulnerability in the codepeople Calculated Fields Form WordPress plugin. It arises from uncontrolled resource consumption (CWE-400) due to unlimited height and width parameters for CAPTCHA images. Attackers can send multiple requests with large parameter values without authentication, potentially causing Denial of Service by exhausting server resources. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low complexity, no privileges or user interaction required, and impact limited to availability loss.
Potential Impact
Successful exploitation results in Denial of Service by slowing or disrupting server availability due to resource exhaustion. There is no impact on confidentiality or integrity. The vulnerability can be triggered remotely by unauthenticated attackers.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing server-level protections such as rate limiting or CAPTCHA parameter validation to mitigate potential abuse. Monitor for unusual traffic patterns targeting CAPTCHA parameters.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-12-13T00:38:11.068Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6e44b7ef31ef0b59c026
Added to database: 2/25/2026, 9:48:52 PM
Last enriched: 4/9/2026, 7:25:54 PM
Last updated: 4/12/2026, 9:21:11 AM
Views: 20
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.