12 Step Meeting List - Information Disclosure (CVE-2025-24582)
Description
The 12 Step Meeting List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.5. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data via two AJAX endpoints: tsml_info and tsml_geocodes.
psychologyCrowdSec Analysis
CVE-2025-24582 is a medium-severity information disclosure vulnerability in the 12 Step Meeting List WordPress plugin (versions up to 3.16.5). Due to missing authorization checks on two AJAX endpoints, unauthenticated attackers can retrieve sensitive configuration data including PHP version, WordPress version, memory limits, and geocode location information.
CrowdSec has been tracking this vulnerability and its exploits since 1st of February 2025.
Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-24582 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2025-24582 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2025-24582 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.
Attackers exploit the /wp-admin/admin-ajax.php endpoint by sending GET requests with the action parameter set to tsml_info or tsml_geocodes to extract sensitive plugin and server configuration data without authentication.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-02-01 |
| Rule Released | 2025-02-01 |
| CrowdSec First Seen | 2026-03-27 |