CVE-2024-12542: linkID WordPress Information Disclosure

CVE-2024-12542 Overview

CVE-2024-12542 affects the linkID plugin for WordPress in all versions up to and including 0.1.2. The plugin exposes the PHP phpinfo() function through a utility script that lacks a capability check. Unauthenticated attackers can request the script remotely and read PHP configuration settings, environment variables, loaded modules, and other server-side data. The plugin does not need to be activated for exploitation, which broadens the attack surface to any WordPress site where the plugin files are present on disk. The flaw is tracked under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated remote attackers can retrieve full PHP environment details, including paths, modules, and configuration values, which accelerates follow-on attacks against the host.

Affected Products

linkID plugin for WordPress, all versions up to and including 0.1.2
Vulnerable file: lib/linkid/linkid-sdk-php/util/index.php
WordPress installations containing the plugin files, even when the plugin is deactivated

Discovery Timeline

2025-01-09 - CVE-2024-12542 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-12542

Vulnerability Analysis

The linkID plugin ships a PHP utility script at lib/linkid/linkid-sdk-php/util/index.php that invokes phpinfo() when the script is requested. The script performs no authorization, authentication, or capability checks before producing output. Any user able to send an HTTP request to the file can retrieve the response.

The output of phpinfo() is sensitive. It includes the PHP version, disable_functions settings, loaded extensions, open_basedir paths, server variables, document root, environment variables, and database client library versions. Attackers use this information to fingerprint the host, identify exploitable PHP versions, locate writable directories, and prepare targeted follow-on payloads.

Because WordPress serves plugin files directly from wp-content/plugins/ over HTTP, the script is reachable without authenticating to WordPress. Deactivating the plugin in the admin console does not remove the files, so the exposure persists until the plugin is uninstalled or the file is blocked.

Root Cause

The root cause is a missing authorization check ([CWE-862]) on a script that produces sensitive diagnostic output. The script was likely included as a development aid in the bundled linkid-sdk-php SDK and was shipped to production users without removal or access restrictions.

Attack Vector

Exploitation requires only an HTTP GET request to the plugin's util/index.php path. No credentials, user interaction, or plugin activation are required. The attacker reads the rendered phpinfo() page from the response body. See the Wordfence Vulnerability Report and the WordPress Plugin SDK Code for the vulnerable source reference.

Detection Methods for CVE-2024-12542

Indicators of Compromise

HTTP GET requests to URIs containing /wp-content/plugins/linkid/lib/linkid/linkid-sdk-php/util/index.php
HTTP 200 responses to the above path with content length consistent with a rendered phpinfo() page
Requests from unauthenticated clients targeting plugin SDK utility paths across multiple WordPress hosts

Detection Strategies

Search web server access logs for any request path matching linkid-sdk-php/util/index.php and flag successful responses.
Inspect outbound response bodies via a web application firewall for the string phpinfo() or PHP Version headings tied to plugin utility paths.
Run authenticated vulnerability scans against WordPress installations to enumerate the linkID plugin and its installed version.

Monitoring Recommendations

Alert on unauthenticated requests to any .php file located under wp-content/plugins/ that returns large HTML bodies.
Track repeated reconnaissance patterns from a single source IP enumerating plugin paths.
Forward WordPress and web server logs to a centralized log platform for retention and correlation across sites.

How to Mitigate CVE-2024-12542

Immediate Actions Required

Remove the linkID plugin directory entirely from wp-content/plugins/ until a fixed version is released.
Block HTTP access to lib/linkid/linkid-sdk-php/util/index.php at the web server or WAF layer.
Audit web server access logs for prior successful requests to the vulnerable path and treat impacted hosts as having leaked configuration data.

Patch Information

At the time of publication, no fixed version of the linkID plugin is listed for versions through 0.1.2. Monitor the WordPress Plugin SDK Code repository and the Wordfence Vulnerability Report for patch availability.

Workarounds

Delete or rename the file wp-content/plugins/linkid/lib/linkid/linkid-sdk-php/util/index.php.
Add a web server rule that denies requests to plugin SDK utility paths.
Disable phpinfo globally by adding phpinfo to the disable_functions directive in php.ini.

bash

# Apache: deny access to the vulnerable utility script
# Place in the site .htaccess or vhost configuration
<Files "index.php">
    Require all denied
</Files>

# Nginx: block the vulnerable path
location ~* /wp-content/plugins/linkid/lib/linkid/linkid-sdk-php/util/ {
    deny all;
    return 403;
}

# php.ini: disable phpinfo system-wide
disable_functions = phpinfo