PoC code for unauthenticated arbitrary shortcode execution vulnerability in WordPress WP Photo Album Plus plugin.
- Affected Versions: <= 8.8.08.007
- CVSS Score: 7.3 (High)
- Vulnerability Type: Arbitrary Shortcode Execution
The WP Photo Album Plus plugin allows unauthenticated users to execute arbitrary shortcodes due to a validation flaw in the getshortcodedrenderedfenodelay AJAX action.
git clone https://github.com/reinh3rz/CVE-2024-10958-WPPA-Exploit.git
cd CVE-2024-10958-WPPA-Exploit
pip install -r requirements.txt
python3 exploit.py -u http://target-site.com
This tool is for educational and research purposes only. It should only be used on systems where you have permission. The user is responsible for any unauthorized use.