CVE-2024-31377 CRITICAL

CVE-2024-31377: WordPress WP Photo Album Plus plugin <= 8.7.01.001 - Unauth. Arbitrary File Upload vulnerability

Vendor J.n. Breetvelt A.k.a. Opajaap
Product WP Photo Album Plus
Weakness CWE-434 · Unrestricted file upload
Published May 13, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a through 8.7.01.001.

Explanation of Vulnerability in Simple Terms

02Summary

WP Photo Album Plus versions up to 8.7.01.001 allow unauthenticated attackers to upload files without restriction. An attacker can upload malicious files—including PHP scripts—directly to the site, gaining the ability to run their own code on the server. No user interaction or authentication is required. This affects all installations of the plugin.

What an attacker can do

03Attacker Capabilities

Upload and execute malicious files, including PHP code, to take full control of the site.

Potential impact on your site

04Site Impact

Complete site compromise: attackers can read/modify/delete all data, create admin accounts, or use the site to attack others.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

May 13, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-48945 Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26 CVE-2026-6692 Slider Revolution 7.0.0 - 7.0.10 - Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url CVE-2026-4885 Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload CVE-2026-57827 Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 CVE-2026-56291 Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1