WpHealth WP Umbrella - LFI (CVE-2024-12209)

CVE-2024-12209 is a Local File Inclusion (LFI) vulnerability in the WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress. The vulnerability allows unauthenticated attackers to include and execute arbitrary files on the server via the 'filename' parameter of the 'umbrella-restore' action, potentially leading to code execution and sensitive data exposure.

CrowdSec has been tracking this vulnerability and its exploits since 30th of June 2025.

Data from the CrowdSec community indicates that exploitation of CVE-2024-12209 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2024-12209 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2024-12209 is currently experiencing high visibility and active exploitation across the internet.

Exploitation of CVE-2024-12209 involves sending a crafted request to the vulnerable plugin's 'umbrella-restore' action with a malicious 'filename' parameter.