CVE-2024-0212: Cloudflare WordPress plugin enables information disclosure of Cloudflare API (for low privileged users)

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-29 · updated 2026-06-17
Weakness: CWE-284

Description

The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower privileged account to access data from the Cloudflare API.

Affected products

Cloudflare-WordPress: before 4.12.3 — fixed in 4.12.3

How to fix

Upgrade to a fixed version: Cloudflare-WordPress 4.12.3. Check the vendor advisory for mitigations.

References

https://github.com/cloudflare/Cloudflare-WordPress/releases/tag/v4.12.3
https://github.com/cloudflare/Cloudflare-WordPress/security/advisories/GHSA-h2fj-7r3m-7gf2
https://github.com/cloudflare/Cloudflare-WordPress/releases/tag/v4.12.3
https://github.com/cloudflare/Cloudflare-WordPress/security/advisories/GHSA-h2fj-7r3m-7gf2

Get alerted when CVE-2024-0212 or the next vulnerability affects your stack