CVE-2024-12535: WordPress Host PHP Info Plugin Vulnerability

CVE-2024-12535 Overview

CVE-2024-12535 affects the Host PHP Info plugin for WordPress in all versions up to and including 1.0.4. The plugin exposes the phpinfo() function without a capability check, allowing unauthenticated attackers to read server configuration data over the network. The plugin does not need to be activated for the flaw to be exploitable, which broadens the attack surface to any WordPress site with the plugin installed. The weakness is categorized as Missing Authorization [CWE-862].

Critical Impact
Unauthenticated remote attackers can retrieve PHP configuration details, environment variables, loaded modules, file paths, and other predefined server variables that aid follow-on attacks.

Affected Products

Host PHP Info plugin for WordPress, versions 1.0.0 through 1.0.4
WordPress installations where the plugin files exist on disk, even if not activated
Any hosting environment exposing the plugin's info.php endpoint

Discovery Timeline

2025-01-07 - CVE-2024-12535 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-12535

Vulnerability Analysis

The Host PHP Info plugin ships an info.php script that calls the PHP built-in phpinfo() function. The script is reachable directly through its file path under the plugin directory and contains no authentication or capability verification. Any unauthenticated client that can issue HTTP requests to the WordPress host can trigger the output. The Exploit Prediction Scoring System (EPSS) places this issue in the 95th percentile, indicating elevated likelihood of exploitation activity.

Root Cause

The root cause is the absence of a current_user_can() capability check or equivalent authorization gate before invoking phpinfo(). WordPress plugins that expose administrative diagnostic functionality must restrict access to privileged roles. Here, the file is loaded directly by the web server rather than routed through WordPress hooks, bypassing standard access controls. The flaw maps to CWE-862: Missing Authorization.

Attack Vector

Exploitation requires only a single unauthenticated HTTP GET request to the plugin's info.php file inside wp-content/plugins/host-php-info/. The server returns the full phpinfo() page, disclosing PHP version, loaded extensions, disk_free_space paths, environment variables, database driver configuration, and HTTP request headers. Attackers use this data to fingerprint the stack, identify vulnerable PHP versions, locate sensitive paths, and harvest tokens that may appear in environment variables. The plugin does not need activation, so dormant installations remain exploitable. Refer to the WordPress Plugin Code Reference and the Wordfence Vulnerability Report for source-level detail.

Detection Methods for CVE-2024-12535

Indicators of Compromise

HTTP GET requests to /wp-content/plugins/host-php-info/info.php in web server access logs
Responses with HTTP 200 status and Content-Length values consistent with full phpinfo() output (typically 60KB or larger)
Repeated requests from a single source IP enumerating plugin paths across multiple WordPress sites

Detection Strategies

Search web server and WAF logs for the exact URI pattern host-php-info/info.php regardless of query string
Alert on outbound responses containing strings such as PHP Version, phpinfo(), Loaded Configuration File, or _SERVER["DOCUMENT_ROOT"] from unexpected URIs
Inventory WordPress plugin directories for the host-php-info folder, even when the plugin is deactivated

Monitoring Recommendations

Ingest WordPress access logs into a centralized analytics platform and add a persistent rule for the vulnerable path
Monitor for scanner User-Agent strings such as wpscan, Nuclei, or generic curl/python-requests hitting plugin file paths
Track 200-response sizes against a baseline to flag information disclosure pages

How to Mitigate CVE-2024-12535

Immediate Actions Required

Delete the host-php-info plugin directory from wp-content/plugins/ on every WordPress installation
Block external access to the info.php file at the web server or WAF layer until removal is confirmed
Audit phpinfo() output for any credentials, API keys, or database strings that may now be considered exposed and rotate them

Patch Information

As of the latest NVD update, no fixed version of the Host PHP Info plugin has been published. Removal of the plugin is the recommended remediation. Track the Wordfence Vulnerability Report for any future vendor update.

Workarounds

Add a web server rule denying requests to wp-content/plugins/host-php-info/info.php
Restrict access to the plugin directory via .htaccessRequire all denied or an Nginx location deny block
Disable the phpinfo function globally by adding it to the disable_functions directive in php.ini where operationally acceptable

bash

# Apache .htaccess block for the vulnerable endpoint
<Files "info.php">
    Require all denied
</Files>

# Nginx equivalent
location ~* /wp-content/plugins/host-php-info/info\.php$ {
    deny all;
    return 403;
}

# Remove the plugin entirely (preferred)
rm -rf /var/www/html/wp-content/plugins/host-php-info