CVE-2024-12417 is a code injection vulnerability in the Simple Link Directory plugin for WordPress by quantumcloud. The vulnerability arises because the plugin allows execution of arbitrary shortcodes without proper validation of user-supplied input before invoking the do_shortcode function. This flaw enables unauthenticated attackers to execute arbitrary shortcode actions, potentially leading to limited confidentiality and integrity impacts. The vulnerability affects all versions up to and including 8.4.5. The CVSS 3.1 base score is 6.5, indicating a medium severity. No patch or official fix has been referenced in the available data.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary shortcodes within the WordPress environment running the vulnerable plugin. This may lead to partial compromise of confidentiality and integrity of the affected system. There is no indication of availability impact. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the Simple Link Directory plugin if it is not essential. Monitor vendor channels for updates and apply patches promptly once available.