CVE-2024-12601
Calculated Fields Form <= 5.2.63 - Denial of Service
- State
- Published
- Severity
- 5.3 Medium
- Published
- Dec 17, 2024
- Updated
- Apr 8, 2026
- Reserved
- Dec 13, 2024
Description
The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. This is due to unlimited height and width parameters for CAPTCHA images. This makes it possible for unauthenticated attackers to send multiple requests with large values, resulting in slowing server resources if the server does not mitigate Denial of Service attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | Wordfence |
Weaknesses
- CWE-400 Uncontrolled Resource Consumption
Affected Products
| Product | Versions |
|---|---|
Calculated Fields Formcodepeople |
|
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1eade2ed-9a75-4857-a2c5-a21e016e7029?source=cve
- https://plugins.trac.wordpress.org/browser/calculated-fields-form/trunk/captcha/captcha.php#L74
- https://plugins.trac.wordpress.org/browser/calculated-fields-form/trunk/captcha/captcha.php#L75
- https://plugins.trac.wordpress.org/changeset/3207826/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.