CVE-2024-31286 CRITICAL

CVE-2024-31286: WordPress WP Photo Album Plus plugin < 8.6.03.005 - Arbitrary File Upload vulnerability

Vendor J.n. Breetvelt A.k.a. Opajaap
Product WP Photo Album Plus
Weakness CWE-434 · Unrestricted file upload
Published April 7, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.9/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a before 8.6.03.005.

Explanation of Vulnerability in Simple Terms

02Summary

WP Photo Album Plus before version 8.6.03.005 allows authenticated users with low privileges to upload files without proper validation. An attacker can upload malicious files—including PHP code—that execute on the server. The vulnerability affects the entire site because uploaded files can be accessed and executed, potentially compromising all data and functionality.

What an attacker can do

03Attacker Capabilities

Upload and execute malicious files (including PHP code) on the server.

Potential impact on your site

04Site Impact

Complete site compromise: attackers can read/modify all data, create admin accounts, or take the site offline.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account (e.g., subscriber or contributor role).

Key dates

06Disclosure timeline

April 7, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-65455 WordPress MapSVG plugin <= 8.14.0 - Arbitrary File Upload vulnerability CVE-2026-39527 WordPress WpStream plugin < 4.11.2 - Arbitrary File Upload vulnerability CVE-2026-7537 MDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Parameter CVE-2026-57827 Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 CVE-2026-9227 GutenBee <= 2.20.1 - Authenticated (Author+) Arbitrary File Upload via wp_check_filetype_and_ext Filter