Insecure Direct Object Reference in PeepSo Core: File Uploads Plugin for WordPress

CVE-2024-8988

What is CVE-2024-8988?

The PeepSo Core: File Uploads plugin for WordPress suffers from a vulnerability that enables unauthorized access to files through the file_download REST API endpoint. This occurs due to a lack of proper validation for a user-controlled key, potentially allowing unauthenticated attackers to download files uploaded by other users. This vulnerability may lead to the exposure of sensitive information, making it imperative for users to update to the latest version of the plugin to mitigate risks.

References