CVE-2024-12417: WordPress Simple Link Directory RCE Flaw

CVE-2024-12417 Overview

The Simple Link Directory plugin for WordPress contains an arbitrary shortcode execution vulnerability affecting all versions up to and including 8.4.5. The plugin fails to validate input before passing it to the do_shortcode function inside the embed/qcopd-embed-link.php handler. Unauthenticated attackers can invoke arbitrary shortcodes registered on the WordPress site by sending crafted requests to the vulnerable embed endpoint. The flaw is categorized under CWE-94 (Improper Control of Generation of Code). Successful exploitation can expose data or trigger unintended behavior depending on which shortcodes are registered on the target site.

Critical Impact
Unauthenticated network attackers can execute arbitrary WordPress shortcodes, potentially disclosing sensitive information or abusing plugin-provided functionality without any user interaction.

Affected Products

WordPress Simple Link Directory plugin versions ≤ 8.4.5
WordPress sites with additional plugins that register privileged or sensitive shortcodes
WordPress installations exposing the plugin's embed link endpoint to unauthenticated visitors

Discovery Timeline

2024-12-13 - CVE-2024-12417 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12417

Vulnerability Analysis

The Simple Link Directory plugin exposes an embed handler in embed/qcopd-embed-link.php that receives user-controlled input and forwards it to WordPress's do_shortcode function without adequate validation. WordPress's do_shortcode executes any registered shortcode contained within a supplied string. When attacker-controlled data reaches this sink, the attacker chooses which shortcodes run and with which attributes.

Because the endpoint accepts requests without authentication, the attack surface is exposed to any unauthenticated visitor over the network. Impact depends on the shortcodes registered by the WordPress core, the theme, or other installed plugins. Many plugins register shortcodes that render user data, form submissions, or authenticated content, which can result in information disclosure or unintended state changes.

Root Cause

The root cause is missing input validation before invocation of do_shortcode. The plugin trusts request parameters and treats them as safe shortcode content. This is a classic CWE-94 code injection pattern where user data is interpreted as executable directives by the application runtime.

Attack Vector

Exploitation requires only a network request to the vulnerable embed endpoint. No authentication, privileges, or user interaction are required. An attacker crafts a request containing shortcode syntax targeting any shortcode registered on the site and receives the rendered output. Refer to the WordPress Plugin Embed Link Code and the Wordfence Vulnerability Report for the vulnerable code path and analysis.

Detection Methods for CVE-2024-12417

Indicators of Compromise

Unauthenticated HTTP requests to the plugin's qcopd-embed-link.php endpoint containing shortcode syntax such as bracketed tags in query or POST parameters.
Anomalous plugin embed responses returning content sourced from unrelated shortcodes (contact forms, user lists, private post data).
Repeated probing of the embed endpoint from a single source enumerating shortcode names.

Detection Strategies

Inspect web server access logs for requests targeting /wp-content/plugins/simple-link-directory/embed/qcopd-embed-link.php with parameter values containing [ and ] characters.
Enable a WordPress Web Application Firewall rule set that blocks unauthenticated shortcode injection attempts against plugin endpoints.
Correlate embed endpoint requests with subsequent unusual database queries or outbound requests triggered by dynamic shortcodes.

Monitoring Recommendations

Alert on any request to the vulnerable embed script that includes URL-encoded shortcode delimiters (%5B, %5D).
Monitor WordPress plugin inventory to identify hosts running Simple Link Directory ≤ 8.4.5.
Track the plugin's version through management tooling and flag installations that lag behind the patched release.

How to Mitigate CVE-2024-12417

Immediate Actions Required

Update the Simple Link Directory plugin to the version that includes the fixes shipped in changeset 3206971 and changeset 3232625.
Audit installed plugins for shortcodes that render sensitive data and consider deregistering shortcodes that are not in use.
Review web server and application logs for prior exploitation attempts targeting the embed endpoint.

Patch Information

The plugin maintainers addressed the issue in updates tracked by WordPress plugin repository changesets 3206971 and 3232625. Both changesets modify embed/qcopd-embed-link.php to validate input before invoking do_shortcode. Site administrators should upgrade to a version later than 8.4.5 through the WordPress admin dashboard or via the plugin repository.

Workarounds

Restrict access to wp-content/plugins/simple-link-directory/embed/qcopd-embed-link.php at the web server or WAF layer until the patch is applied.
Temporarily deactivate the Simple Link Directory plugin if the embed functionality is not required.
Deploy a virtual patch in the WAF that strips or blocks shortcode delimiters in requests to the vulnerable endpoint.

bash

# Example nginx location block to deny unauthenticated access to the vulnerable endpoint
location ~* /wp-content/plugins/simple-link-directory/embed/qcopd-embed-link\.php$ {
    deny all;
    return 403;
}