Description
The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 0.1.2. This makes it possible for unauthenticated attackers to read configuration settings and predefined variables on the site's server. The plugin does not need to be activated for the vulnerability to be exploited.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| linkid | linkID | ≤ 0.1.2 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
RandomRobbieBF/CVE-2024-12542 ★ 1 · Jan 10, 2025
linkID <= 0.1.2 - Missing Authorization to Unauthenticated Sensitive Information Exposure
-
Nxploited/CVE-2024-12542-PoC ★ 0 · Feb 4, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.