CVE-2024-12365

CVE-2024-12365 is a high-severity vulnerability affecting the W3 Total Cache plugin for WordPress, impacting all versions up to and including 2.8.1. It allows authenticated attackers with Subscriber-level access to bypass capability checks, obtain nonce values, and perform unauthorized actions. This can lead to information disclosure, consumption of service plan limits, and server-side request forgery (SSRF) to internal services, including cloud instance metadata. While there is no known active exploitation or public exploit code, the vulnerability has garnered significant community discussion and media coverage, indicating a high potential for future exploitation.