Insecure Direct Object Reference in PeepSo Core: File Uploads Plugin for WordPress
CVE-2024-8988

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Peepso Core: File Uploads
Vendor
CVE Published:
14 May 2025

What is CVE-2024-8988?

The PeepSo Core: File Uploads plugin for WordPress suffers from a vulnerability that enables unauthorized access to files through the file_download REST API endpoint. This occurs due to a lack of proper validation for a user-controlled key, potentially allowing unauthenticated attackers to download files uploaded by other users. This vulnerability may lead to the exposure of sensitive information, making it imperative for users to update to the latest version of the plugin to mitigate risks.

Affected Version(s)

PeepSo Core: File Uploads * <= 6.4.6.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://www.peepso.com/changelog/

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bikram Kharal
.
CVE-2024-8988 : Insecure Direct Object Reference in PeepSo Core: File Uploads Plugin for WordPress