CVE-2024-12542
Published: 09 January 2025
Summary
CVE-2024-12542 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and CM-7 (Least Functionality).
Deeper analysis
The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the phpinfo function in all versions up to and including 0.1.2. This flaw, tracked as CVE-2024-12542 and assigned CWE-862, enables unauthenticated attackers to retrieve configuration settings and predefined server variables. The issue affects the plugin even when it is not activated, and carries a CVSS 3.1 score of 8.6 reflecting network attack vector, low complexity, and high confidentiality impact with changed scope.
Unauthenticated remote attackers can directly invoke the affected code path to disclose sensitive server information without any authentication or user interaction. The vulnerability resides in the linkid-sdk-php util component, allowing exposure of environment details that could aid further reconnaissance or targeted attacks against the WordPress site and its underlying server.
The current EPSS score of 0.3654 matches its recorded peak with no material rise observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-50945
Vulnerability details
The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 0.1.2. This makes it possible for unauthenticated attackers to read…
more
configuration settings and predefined variables on the site's server. The plugin does not need to be activated for the vulnerability to be exploited.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization in public-facing WordPress plugin directly enables remote unauthenticated exploitation (T1190) resulting in system configuration and environment variable disclosure (T1082).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces the missing capability check to prevent unauthenticated attackers from accessing the phpinfo function and exposing server configuration settings.
Mandates timely identification, reporting, and correction of the authorization flaw in linkID plugin versions up to 0.1.2, eliminating the vulnerability through patching or removal.
Restricts the system to essential capabilities by prohibiting unnecessary plugins like linkID, preventing exploitation even when the plugin is not activated.