Unauthenticated Arbitrary Shortcode Execution Vulnerability in Album and Image Gallery plus Lightbox Plugin for WordPress

CVE-2024-4194

Summary

The Album and Image Gallery plus Lightbox plugin for WordPress contains a vulnerability that enables arbitrary shortcode execution across all versions up to and including 2.0. This issue arises from the plugin's failure to correctly validate user inputs before executing specific actions through the do_shortcode function. Consequently, unauthenticated attackers may exploit this weakness to inject and execute arbitrary shortcodes, potentially leading to unauthorized access or manipulation of site content. Website owners utilizing this plugin should take immediate action to secure their installations.

References