CVE-2024-10958

HIGH

WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Shortcode Execution via getshortcoderenderedfenodelay

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-10958. PoCs published by reinh3rz.

AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2024-10958, an arbitrary shortcode execution vulnerability in WordPress WP Photo Album Plus. The exploit sends a crafted POST request to the vulnerable AJAX endpoint, allowing unauthenticated users to execute arbitrary shortcodes.

Description

The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrenderedfenodelay AJAX action in all versions up to, and including, 8.8.08.007 . This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Exploits (1)

nomisec WORKING POC 1 stars
by reinh3rz · poc
https://github.com/reinh3rz/CVE-2024-10958-WPPA-Exploit

This repository contains a functional Python exploit for CVE-2024-10958, an arbitrary shortcode execution vulnerability in WordPress WP Photo Album Plus. The exploit sends a crafted POST request to the vulnerable AJAX endpoint, allowing unauthenticated users to execute arbitrary shortcodes.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: WordPress WP Photo Album Plus <= 8.8.08.007
No auth needed
Prerequisites: Target must have WP Photo Album Plus plugin installed and vulnerable version
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (4)

Core 4

Scores

CVSS v3 7.3
EPSS 0.0158
EPSS Percentile 72.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-94
Status published
Products (2)
opajaap/WP Photo Album Plus < 8.8.08.007
wppa/wp_photo_album_plus < 8.9.01.001
Published Nov 10, 2024
Tracked Since Feb 18, 2026