CVE-2024-4037 is a medium severity code injection flaw in the WP Photo Album Plus plugin for WordPress. NVD scores it 6.5. Versions up to and including 8.7.02.003 let unauthenticated visitors run arbitrary shortcodes. Update to the latest release and confirm the fixed version in the plugin changelog.
What's affected
The record covers all versions of WP Photo Album Plus up to and including 8.7.02.003. The cause, as the record describes it, is an action reachable by unauthenticated users that passes a value to do_shortcode without validating it. NVD gives the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N: network access, no privileges, no user interaction, with low confidentiality and integrity impact.
The record does not name a fixed version. It points to changesets in the WordPress plugin repository and to a Wordfence entry, and we did not fetch them. Check the plugin changelog for the release that follows 8.7.02.003 and confirm it mentions this issue.
Weakness class: CWE-94 (code injection).
How to check if you're exposed
From the WordPress admin, open Plugins, Installed Plugins, and read the version under the plugin name. With WP-CLI on the server you can read it directly:
wp plugin list --fields=name,version,update
Compare the version to the affected range above. If the update column shows available, apply it after a backup.
What to do now
- Find every WordPress site that has WP Photo Album Plus installed, including staging and forgotten sites.
- Update the plugin to the newest release available and read the changelog for this fix.
- If you cannot update today, deactivate the plugin on public sites until you can.
- Review which shortcodes your site registers. Any shortcode that reads files, runs queries or prints data adds risk if an outside visitor can trigger it.
- Check web server logs for odd requests to the plugin AJAX endpoint around and after the disclosure date, 24 May 2024.
- Turn on automatic plugin updates for plugins you rely on.
Why it matters
A shortcode is a small tag, written in square brackets, that WordPress expands into content or behaviour. Running one is normally limited to people who can edit posts. This flaw let an outside visitor choose which shortcode runs, because the plugin passed an unchecked value to the function that expands them.
The damage depends on what else is installed. A harmless shortcode prints text. A shortcode from another plugin could read data or change settings. That is why NVD rates the impact as low rather than high, and why the real risk varies from site to site. The record does not say this is exploited in the wild and the KEV flag is false.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory of vulnerability pages for software you already track.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need an account?
No. The record says unauthenticated users can trigger it.
What is the fixed version?
The record does not state one. Check the plugin changelog for the release after 8.7.02.003.
Sources
These are the references listed in the record. We did not fetch them for this draft, so the version and fix details above come from the record alone and the advisory should be checked.
Last reviewed: 19 October 2026.
