Unauthorized Shortcode Execution Vulnerability in Simple Link Directory Plugin
CVE-2024-12417

6.5MEDIUM

Key Information:

Vendor
Wordpress
Status
Simple Link Directory
Vendor
CVE Published:
13 December 2024

Summary

The Simple Link Directory plugin for WordPress has a vulnerability that allows for arbitrary shortcode execution. This issue affects all versions up to and including 8.4.0. The vulnerability arises because the software does not adequately validate user inputs before executing the 'do_shortcode' function, enabling unauthenticated attackers to execute arbitrary shortcodes. This poses a significant risk as it can lead to unauthorized actions being performed on the site, making it crucial for users to address this vulnerability promptly.

Affected Version(s)

Simple Link Directory * <= 8.4.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/simple-link-di...
https://plugins.trac.wordpress.org/changeset/3206971/simp...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arkadiusz Hydzik
.