W3 Total Cache < 2.8.2 - Log File Exposure
CVE-2024-12008
Verified
Description
The plugin is vulnerable to Information Exposure through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF attacks.
Severity
Medium
CVSS Score
5.3
Exploit Probability
2%
Affected Product
w3-total-cache
Published Date
June 11, 2026
Template Author
ritikchaddha
CVE-2024-12008.yaml
5.3Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2024-12008
CWE ID:
cwe-532
Remediation Steps
Update the W3 Total Cache plugin to version 2.8.2 or later, which restricts access to debug log files. Additionally, disable debug logging in production environments and ensure .htaccess rules block direct access to the cache/log directory.