CVE-2025-2880: Yame Link In Bio Information Disclosure

CVE-2025-2880 Overview

CVE-2025-2880 affects the Yame | Link In Bio plugin for WordPress in all versions up to and including 0.9.0. The plugin ships a publicly accessible phpinfo.php script located inside the bundled phpfastcache vendor directory. Unauthenticated attackers can request this file directly over the network and view PHP configuration details, environment variables, loaded modules, and server paths. The exposure maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can retrieve PHP configuration and server environment data useful for chaining follow-on attacks against the WordPress host.

Affected Products

Yame | Link In Bio plugin for WordPress, versions <= 0.9.0
Deployments bundling phpfastcache example files under the plugin vendor directory
WordPress sites exposing plugin paths without web server restrictions

Discovery Timeline

2025-05-02 - CVE-2025-2880 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD

Technical Details for CVE-2025-2880

Vulnerability Analysis

The plugin distribution includes a demonstration script at vendor/phpfastcache/phpfastcache/examples/phpinfo.php. The script calls the PHP phpinfo() function and returns the full output to any HTTP client. Because WordPress serves plugin static assets by default, the file is reachable at a predictable URL beneath /wp-content/plugins/yame-linkinbio/.

An unauthenticated attacker only needs to issue a single HTTP GET request to the known path. The response discloses PHP version, disable_functions settings, loaded extensions, absolute file system paths, environment variables, and session configuration. This information supports reconnaissance for further exploitation, including targeting known PHP vulnerabilities or crafting path traversal payloads.

Root Cause

The root cause is a packaging defect. The upstream phpfastcache library ships example files that are intended for local testing, not production deployment. The plugin author bundled the entire vendor tree without removing the examples directory or restricting web access to it, leaving the diagnostic script exposed on every installation.

Attack Vector

Exploitation requires only network access to the WordPress site. The attacker sends a request such as GET /wp-content/plugins/yame-linkinbio/vendor/phpfastcache/phpfastcache/examples/phpinfo.php and parses the HTML response. No authentication, cookies, or user interaction are involved. Technical details are documented in the Wordfence Vulnerability Report and the WordPress Plugin Example File.

Detection Methods for CVE-2025-2880

Indicators of Compromise

HTTP requests to /wp-content/plugins/yame-linkinbio/vendor/phpfastcache/phpfastcache/examples/phpinfo.php
Successful 200 OK responses served from the plugin examples directory
Unusual User-Agent strings enumerating plugin paths across many WordPress hosts

Detection Strategies

Search web server access logs for any request path containing phpfastcache/examples/phpinfo.php
Alert on responses with content length consistent with phpinfo() output originating from /wp-content/plugins/
Run authenticated vulnerability scans against WordPress hosts to flag reachable example scripts under plugin vendor directories

Monitoring Recommendations

Forward Apache, Nginx, or WAF access logs to a centralized analytics platform and query for plugin path enumeration patterns
Baseline expected plugin URLs and alert on requests to .php files outside of WordPress core entry points
Track outbound scans from workstations to public WordPress hosts for the same URL signature indicating reconnaissance

How to Mitigate CVE-2025-2880

Immediate Actions Required

Delete the file wp-content/plugins/yame-linkinbio/vendor/phpfastcache/phpfastcache/examples/phpinfo.php from every affected site
Deactivate the Yame | Link In Bio plugin until a patched release is verified from the WordPress Plugin Developer Page
Review historical access logs for prior successful requests to the vulnerable path and treat those hosts as reconnaissance targets

Patch Information

At the time of the last NVD update on 2026-06-17, no vendor-supplied patched version was recorded in the enriched data. Administrators should monitor the WordPress Plugin Developer Page for a release above 0.9.0 and apply it once available.

Workarounds

Block web access to the plugin vendor and examples directories through the web server configuration
Deploy a Web Application Firewall rule that denies requests matching phpfastcache/examples/phpinfo.php
Remove or replace the phpinfo.php file with an empty stub during deployment automation

bash

# Nginx configuration to block access to the exposed example script
location ~* /wp-content/plugins/yame-linkinbio/vendor/.*/examples/.*\.php$ {
    deny all;
    return 403;
}

# One-time removal of the vulnerable file
rm -f wp-content/plugins/yame-linkinbio/vendor/phpfastcache/phpfastcache/examples/phpinfo.php