High severity7.5NVD Advisory· Published Mar 7, 2025· Updated Jun 17, 2026

CVE-2024-12036

Description

The CS Framework plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.9 via the get_widget_settings_json() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Affected products

WordPress/Cs Frameworkinferred
Range: <=6.9
Package: https://wordpress.org/plugins/cs-framework
WordPress/CS Framework pluginllm-create
Range: <=6.9

Patches

Vulnerability mechanics

References

themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636nvd
www.wordfence.com/threat-intel/vulnerabilities/id/5ed1978e-1dd7-45d3-829a-1a75c1789827nvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000