Executive brief
Photocart Link is a WordPress plugin used to manage photo galleries. A security flaw in the plugin allows unauthorized individuals to view sensitive files on the website's server. This could lead to the theft of database passwords and other configuration data, potentially allowing a full takeover of the website.
Technical details
A local file inclusion (LFI) vulnerability exists in the 'decode.php' file of the Photocart Link plugin for WordPress. The issue stems from the application's failure to validate the 'id' parameter before passing it to the PHP readfile() function. An unauthenticated attacker can provide a base64-encoded file path (e.g., '../../wp-config.php') to the 'id' parameter to download sensitive system and configuration files. The plugin has been closed and is no longer available for download from the WordPress repository; users should migrate to a supported alternative.
Affected products
- KaymeePhotography Photocart Link 1.6
Timeline
- 2015-03-20: other: Plugin closed on WordPress.org repository
- 2016-03-27: disclosed: Exploit-DB entry published and vendor informed
- 2026-06-15: advisory: CVE published via VulnCheck