reinh3rz/cve-2024-10958-wppa-exploitProof-of-concept exploit for CVE-2024-10958, an unauthenticated arbitrary shortcode execution vulnerability in WordPress WP Photo Album Plus plugin.
PoC code for unauthenticated arbitrary shortcode execution vulnerability in WordPress WP Photo Album Plus plugin.
Due to a missing validation check in the getshortcodedrenderedfenodelay AJAX action, the WP Photo Album Plus plugin allows unauthenticated users to execute arbitrary shortcodes.
cd CVE-2024-10958-WPPA-Exploit
pip install -r requirements.txt
python3 exploit.py -u http://target-site.com
This tool is for educational and research purposes only. It should only be used on authorized systems. Unauthorized use is the sole responsibility of the user.
