Unauthorized Shortcode Execution Vulnerability in Simple Link Directory Plugin

CVE-2024-12417

What is CVE-2024-12417?

The Simple Link Directory plugin for WordPress has a vulnerability that allows for arbitrary shortcode execution. This issue affects all versions up to and including 8.4.0. The vulnerability arises because the software does not adequately validate user inputs before executing the 'do_shortcode' function, enabling unauthenticated attackers to execute arbitrary shortcodes. This poses a significant risk as it can lead to unauthorized actions being performed on the site, making it crucial for users to address this vulnerability promptly.

References