CVE-2024-4037: WP Photo Album Plus <= 8.7.02.003 - Unauthenticated Arbitrary Shortcode Execution
The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.7.02.003. This is due to the plugin allowing unauthenticated users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4037?
CVE-2024-4037 is rated as a high severity vulnerability due to its ability to allow arbitrary shortcode execution.
How do I fix CVE-2024-4037?
To fix CVE-2024-4037, update the WP Photo Album Plus plugin to version 8.7.02.004 or later.
Which versions are affected by CVE-2024-4037?
CVE-2024-4037 affects all versions of the WP Photo Album Plus plugin up to and including 8.7.02.003.
Can unauthenticated users exploit CVE-2024-4037?
Yes, CVE-2024-4037 allows unauthenticated users to exploit the vulnerability due to lack of validation.
What type of attack is associated with CVE-2024-4037?
CVE-2024-4037 is associated with arbitrary shortcode execution attacks, which can lead to unauthorized actions on the site.