{"id":3818,"date":"2024-05-23T20:45:08","date_gmt":"2024-05-23T20:45:08","guid":{"rendered":"http:\/\/127.0.0.1\/wp-photo-album-plus-8-7-02-003-ejecucion-de-shortcode-arbitrario-sin-autenticacion\/"},"modified":"2024-05-23T20:45:08","modified_gmt":"2024-05-23T20:45:08","slug":"wp-photo-album-plus-8-7-02-003-ejecucion-de-shortcode-arbitrario-sin-autenticacion","status":"publish","type":"post","link":"http:\/\/127.0.0.1\/wp-photo-album-plus-8-7-02-003-ejecucion-de-shortcode-arbitrario-sin-autenticacion\/","title":{"rendered":"WP Photo Album Plus &lt;= 8.7.02.003 &#8211; Ejecuci\u00f3n de Shortcode Arbitrario sin Autenticaci\u00f3n"},"content":{"rendered":"<div>El plugin WP Photo Album Plus para WordPress es vulnerable a la ejecuci\u00f3n arbitraria de shortcodes en todas las versiones hasta, e incluyendo, la 8.7.02.003. Esto se debe a que el plugin permite a usuarios no autenticados ejecutar una acci\u00f3n que no valida adecuadamente un valor antes de ejecutar do_shortcode. Esto hace posible que atacantes no autenticados ejecuten shortcodes arbitrarios.<\/div>\n<p><\/p>\n<div>Los usuarios afectados por esta vulnerabilidad pueden mitigar el riesgo desactivando temporalmente el plugin WP Photo Album Plus hasta que se lance una actualizaci\u00f3n que aborde este problema. Adem\u00e1s, se recomienda a los usuarios no hacer clic en enlaces sospechosos o abrir archivos adjuntos de fuentes desconocidas para evitar posibles ataques de phishing.<\/div>\n<div>Es crucial que los usuarios de WordPress mantengan sus plugins actualizados y est\u00e9n al tanto de las vulnerabilidades conocidas para proteger sus sitios web de posibles compromisos de seguridad.<\/div>\n","protected":false},"excerpt":{"rendered":"<p>El plugin WP Photo Album Plus para WordPress es vulnerable a la ejecuci\u00f3n arbitraria de shortcodes en todas las versiones hasta, e incluyendo, la 8.7.02.003. Esto se debe a que el plugin permite a usuarios no autenticados ejecutar una acci\u00f3n que no valida adecuadamente un valor antes de ejecutar do_shortcode. Esto hace posible que atacantes [&hellip;]<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1528],"class_list":["post-3818","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-cve-2024-4037"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v21.8 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>WP Photo Album Plus &lt;= 8.7.02.003 - Ejecuci\u00f3n de Shortcode Arbitrario sin Autenticaci\u00f3n - SeguridadWordPress.es<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/127.0.0.1\/wp-photo-album-plus-8-7-02-003-ejecucion-de-shortcode-arbitrario-sin-autenticacion\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"WP Photo Album Plus &lt;= 8.7.02.003 - Ejecuci\u00f3n de Shortcode Arbitrario sin Autenticaci\u00f3n - SeguridadWordPress.es\" \/>\n<meta property=\"og:description\" content=\"El plugin WP Photo Album Plus para WordPress es vulnerable a la ejecuci\u00f3n arbitraria de shortcodes en todas las versiones hasta, e incluyendo, la 8.7.02.003. Esto se debe a que el plugin permite a usuarios no autenticados ejecutar una acci\u00f3n que no valida adecuadamente un valor antes de ejecutar do_shortcode. Esto hace posible que atacantes [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"http:\/\/127.0.0.1\/wp-photo-album-plus-8-7-02-003-ejecucion-de-shortcode-arbitrario-sin-autenticacion\/\" \/>\n<meta property=\"og:site_name\" content=\"SeguridadWordPress.es\" \/>\n<meta property=\"article:published_time\" content=\"2024-05-23T20:45:08+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"http:\/\/127.0.0.1\/wp-photo-album-plus-8-7-02-003-ejecucion-de-shortcode-arbitrario-sin-autenticacion\/\",\"url\":\"http:\/\/127.0.0.1\/wp-photo-album-plus-8-7-02-003-ejecucion-de-shortcode-arbitrario-sin-autenticacion\/\",\"name\":\"WP Photo Album Plus &lt;= 8.7.02.003 - Ejecuci\u00f3n de Shortcode Arbitrario sin Autenticaci\u00f3n - SeguridadWordPress.es\",\"isPartOf\":{\"@id\":\"http:\/\/127.0.0.1\/#website\"},\"datePublished\":\"2024-05-23T20:45:08+00:00\",\"dateModified\":\"2024-05-23T20:45:08+00:00\",\"author\":{\"@id\":\"\"},\"breadcrumb\":{\"@id\":\"http:\/\/127.0.0.1\/wp-photo-album-plus-8-7-02-003-ejecucion-de-shortcode-arbitrario-sin-autenticacion\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/127.0.0.1\/wp-photo-album-plus-8-7-02-003-ejecucion-de-shortcode-arbitrario-sin-autenticacion\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\/\/127.0.0.1\/wp-photo-album-plus-8-7-02-003-ejecucion-de-shortcode-arbitrario-sin-autenticacion\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"http:\/\/127.0.0.1\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"WP Photo Album Plus &lt;= 8.7.02.003 &#8211; Ejecuci\u00f3n de Shortcode Arbitrario sin Autenticaci\u00f3n\"}]},{\"@type\":\"WebSite\",\"@id\":\"http:\/\/127.0.0.1\/#website\",\"url\":\"http:\/\/127.0.0.1\/\",\"name\":\"SeguridadWordPress.es\",\"description\":\"Recopilaci\u00f3n de vulnerabilidades WordPress.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\/\/127.0.0.1\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"WP Photo Album Plus &lt;= 8.7.02.003 - Ejecuci\u00f3n de Shortcode Arbitrario sin Autenticaci\u00f3n - SeguridadWordPress.es","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/127.0.0.1\/wp-photo-album-plus-8-7-02-003-ejecucion-de-shortcode-arbitrario-sin-autenticacion\/","og_locale":"en_US","og_type":"article","og_title":"WP Photo Album Plus &lt;= 8.7.02.003 - Ejecuci\u00f3n de Shortcode Arbitrario sin Autenticaci\u00f3n - SeguridadWordPress.es","og_description":"El plugin WP Photo Album Plus para WordPress es vulnerable a la ejecuci\u00f3n arbitraria de shortcodes en todas las versiones hasta, e incluyendo, la 8.7.02.003. Esto se debe a que el plugin permite a usuarios no autenticados ejecutar una acci\u00f3n que no valida adecuadamente un valor antes de ejecutar do_shortcode. Esto hace posible que atacantes [&hellip;]","og_url":"http:\/\/127.0.0.1\/wp-photo-album-plus-8-7-02-003-ejecucion-de-shortcode-arbitrario-sin-autenticacion\/","og_site_name":"SeguridadWordPress.es","article_published_time":"2024-05-23T20:45:08+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"http:\/\/127.0.0.1\/wp-photo-album-plus-8-7-02-003-ejecucion-de-shortcode-arbitrario-sin-autenticacion\/","url":"http:\/\/127.0.0.1\/wp-photo-album-plus-8-7-02-003-ejecucion-de-shortcode-arbitrario-sin-autenticacion\/","name":"WP Photo Album Plus &lt;= 8.7.02.003 - Ejecuci\u00f3n de Shortcode Arbitrario sin Autenticaci\u00f3n - SeguridadWordPress.es","isPartOf":{"@id":"http:\/\/127.0.0.1\/#website"},"datePublished":"2024-05-23T20:45:08+00:00","dateModified":"2024-05-23T20:45:08+00:00","author":{"@id":""},"breadcrumb":{"@id":"http:\/\/127.0.0.1\/wp-photo-album-plus-8-7-02-003-ejecucion-de-shortcode-arbitrario-sin-autenticacion\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["http:\/\/127.0.0.1\/wp-photo-album-plus-8-7-02-003-ejecucion-de-shortcode-arbitrario-sin-autenticacion\/"]}]},{"@type":"BreadcrumbList","@id":"http:\/\/127.0.0.1\/wp-photo-album-plus-8-7-02-003-ejecucion-de-shortcode-arbitrario-sin-autenticacion\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http:\/\/127.0.0.1\/"},{"@type":"ListItem","position":2,"name":"WP Photo Album Plus &lt;= 8.7.02.003 &#8211; Ejecuci\u00f3n de Shortcode Arbitrario sin Autenticaci\u00f3n"}]},{"@type":"WebSite","@id":"http:\/\/127.0.0.1\/#website","url":"http:\/\/127.0.0.1\/","name":"SeguridadWordPress.es","description":"Recopilaci\u00f3n de vulnerabilidades WordPress.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/127.0.0.1\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"}]}},"amp_enabled":true,"_links":{"self":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/posts\/3818"}],"collection":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/comments?post=3818"}],"version-history":[{"count":0,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/posts\/3818\/revisions"}],"wp:attachment":[{"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/media?parent=3818"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/categories?post=3818"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/127.0.0.1\/wp-json\/wp\/v2\/tags?post=3818"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}