Arbitrary Shortcode Execution Vulnerability in Photo Album Plus Plugin

CVE-2024-10958

What is CVE-2024-10958?

The WP Photo Album Plus plugin for WordPress has a vulnerability that exposes users to arbitrary shortcode execution through an AJAX action known as getshortcodedrenderedfenodelay. This vulnerability arises when the plugin fails to adequately validate user inputs before executing shortcodes with the do_shortcode function. As a consequence, it empowers unauthenticated attackers to leverage this flaw, potentially executing malicious shortcodes and compromising the security of WordPress installations running versions up to and including 8.8.08.007.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References