WP Photo Album Plus < 8.6.01.003 - Insecure Direct Object Reference

2023-12-0900:00:00

wpscan.com

wordpress

plugin

vulnerable

insecure direct object reference

unauthenticated attacker

7.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.3%

JSON

Description The WP Photo Album Plus plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 8.5.02.005 due to missing validation on a user controlled key. This makes it possible for unauthenticated attacker to perform an unauthorized action base don a user controlled key.