# CVE-2025-24582: 12 Step Meeting List - Information Disclosure

> Live exploitation tracking for CVE-2025-24582 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-24582

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.3
- **Public exploit available:** Yes
- **Affected products:** Code for Recovery 12 Step Meeting List
- **Weaknesses:** CWE-306 (Missing Authentication for Critical Function)
- **Tags:** wordpress

## Description

The 12 Step Meeting List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.5. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data via two AJAX endpoints: tsml_info and tsml_geocodes.

## CrowdSec analysis

[CVE-2025-24582](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-24582) is a medium-severity information disclosure vulnerability in the 12 Step Meeting List WordPress plugin (versions up to 3.16.5). Due to missing authorization checks on two AJAX endpoints, unauthenticated attackers can retrieve sensitive configuration data including PHP version, WordPress version, memory limits, and geocode location information.

CrowdSec has been tracking this vulnerability and its exploits since 1st of February 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-24582 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2025-24582 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2025-24582 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Attackers exploit the `/wp-admin/admin-ajax.php` endpoint by sending GET requests with the `action` parameter set to `tsml_info` or `tsml_geocodes` to extract sensitive plugin and server configuration data without authentication.

## Timeline

- 2025-02-01: CVE Published. CVE-2025-24582 is published to NVD.
- 2025-02-01: Rule Released. CrowdSec releases a rule to detect CVE-2025-24582 exploitation attempts against the CrowdSec Network.
- 2026-03-27: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-24582 for the first time.

## References

- https://wpscan.com/vulnerability/e67936e3-a56e-40d4-9647-75c71499ee0a/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/43f34d3b-ed55-48d1-9074-b33f166e333e
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24582.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-24582) follows observed exploitation activity for CVE-2025-24582. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.