CVE-2024-12861 is an Arbitrary File Read vulnerability in the W2S – Migrate WooCommerce to Shopify WordPress plugin, affecting all versions up to 1.2.1. The flaw exists in the 'viw2s_view_log' AJAX action, which improperly validates user input, allowing authenticated users with low privileges (Subscriber-level and above) to specify arbitrary file paths. This can lead to unauthorized disclosure of sensitive server files. The vulnerability is tracked under CWE-73, indicating external control of file name or path. The CVSS 3.1 score of 6.5 reflects a network attack vector with low attack complexity and no user interaction required, but privileges are needed.

An attacker with at least Subscriber-level access to the WordPress site can exploit this vulnerability to read arbitrary files on the server. This can lead to exposure of sensitive information such as configuration files, credentials, or other data stored on the server. The vulnerability does not allow modification or denial of service but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to the 'viw2s_view_log' AJAX action. Consider disabling or removing the plugin if it is not essential.