CVE-2025-2880: 
WordPress vulnerability analysis and mitigation

The Yame | Link In Bio plugin for WordPress contains a Sensitive Information Exposure vulnerability (CVE-2025-2880) affecting all versions up to and including 0.9.0. The vulnerability was discovered and disclosed on May 1, 2025, and stems from a publicly accessible phpinfo.php script in the plugin's vendor directory (NVD, Wiz).

The vulnerability exists due to an exposed phpinfo.php script located in the plugin's vendor directory. This security flaw has been assigned a CVSS v3.1 Base Score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility with low attack complexity and no required privileges (Wiz).

The exposure of the phpinfo.php file allows unauthenticated attackers to access sensitive server configuration information, including installed PHP modules, system paths, and other potentially security-critical details that could be leveraged for further exploitation (Wiz).

The plugin has been temporarily closed as of April 30, 2025, pending a full security review. Users are advised to remove the plugin until a patched version becomes available (WordPress Plugin).