CVE-2024-12420: 
WordPress vulnerability analysis and mitigation

The WPMobile.App — Android and iOS Mobile Application plugin for WordPress has been identified with vulnerability CVE-2024-12420, discovered on December 12, 2024. This security flaw affects all versions up to and including 11.52, allowing unauthenticated attackers to execute arbitrary shortcodes (NVD CVE, Wordfence Intel).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code) with a CVSS v3.1 base score of 6.5 (Medium). The technical issue stems from the plugin's failure to properly validate values before executing the do_shortcode function, creating a potential code injection vulnerability. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N) (NVD CVE).

The vulnerability allows unauthenticated attackers to execute arbitrary shortcodes, potentially leading to unauthorized code execution within the WordPress environment. This could result in limited confidentiality and integrity breaches as indicated by the CVSS metrics (NVD CVE).

Users should update their WPMobile.App plugin to a version newer than 11.52 once available. Until then, website administrators should consider disabling the plugin if it's not critical to their operations (NVD CVE).