CVE-2024-31377: WordPress WP Photo Album Plus plugin <= 8.7.01.001 - Unauth. Arbitrary File Upload vulnerability
Published May 13, 2024
·Updated
Unrestricted Upload of File with Dangerous Type vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a through 8.7.01.001.
Affected Software
1 affected component
wordpress/wp-photo-album-plus<=8.7.01.001
Remediation
Information
Update to 8.7.01.002 or a higher version.
Event History
May 13, 2024
CVE Published
via MITRE·09:06 AM
Data Sourced
via MITRE·09:06 AM
RemedyDescriptionSeverityWeakness
May 14, 2024
Data Sourced
via NVD·03:25 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-31377?
CVE-2024-31377 has been categorized as a high severity vulnerability due to the potential for unrestricted file uploads.
2
How do I fix CVE-2024-31377?
To fix CVE-2024-31377, upgrade WP Photo Album Plus to a version higher than 8.7.01.001.
3
What are the potential risks associated with CVE-2024-31377?
The risks associated with CVE-2024-31377 include unauthorized access and execution of malicious code due to unrestricted file uploads.
4
What versions of WP Photo Album Plus are affected by CVE-2024-31377?
CVE-2024-31377 affects all versions of WP Photo Album Plus from n/a up to and including version 8.7.01.001.
5
Is CVE-2024-31377 an authenticated or unauthenticated vulnerability?
CVE-2024-31377 is an unauthenticated vulnerability, meaning it can be exploited without user authentication.