CVE-2025-2880: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in yame Yame | Link In Bio
The Yame | Link In Bio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.
AI Analysis
Technical Summary
CVE-2025-2880 describes a sensitive information exposure vulnerability in the Yame | Link In Bio WordPress plugin through an exposed phpinfo.php script accessible without authentication. This exposure can reveal potentially sensitive server or environment information to unauthorized actors. The vulnerability affects all versions up to and including 0.9.0. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or official fix information is currently available.
Potential Impact
An unauthenticated attacker can access the phpinfo.php script included in the plugin, potentially gaining access to sensitive server environment information. This exposure could aid attackers in further attacks but does not directly impact integrity or availability. The impact is limited to confidentiality loss of information disclosed by the phpinfo.php output.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the phpinfo.php script by removing or securing it to prevent unauthorized access.
CVE-2025-2880: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in yame Yame | Link In Bio
Description
The Yame | Link In Bio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-2880 describes a sensitive information exposure vulnerability in the Yame | Link In Bio WordPress plugin through an exposed phpinfo.php script accessible without authentication. This exposure can reveal potentially sensitive server or environment information to unauthorized actors. The vulnerability affects all versions up to and including 0.9.0. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or official fix information is currently available.
Potential Impact
An unauthenticated attacker can access the phpinfo.php script included in the plugin, potentially gaining access to sensitive server environment information. This exposure could aid attackers in further attacks but does not directly impact integrity or availability. The impact is limited to confidentiality loss of information disclosed by the phpinfo.php output.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the phpinfo.php script by removing or securing it to prevent unauthorized access.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-03-27T19:25:40.845Z
- Cisa Enriched
- true
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 682d9838c4522896dcbebdf2
Added to database: 5/21/2025, 9:09:12 AM
Last enriched: 4/9/2026, 10:10:58 AM
Last updated: 5/11/2026, 9:07:13 PM
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.