{"id":"CVE-2023-49774","state":"PUBLISHED","title":"WordPress WP Photo Album Plus plugin <= 8.5.02.005 - IP Bypass vulnerability","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005.","publishedAt":"2024-06-04T11:23:29.421Z","updatedAt":"2026-04-28T16:08:57.583Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"Patchstack"},"assigner":"Patchstack","products":["J.N. Breetvelt a.k.a. OpaJaap WP Photo Album Plus"],"affected":[{"vendor":"J.N. Breetvelt a.k.a. OpaJaap","product":"WP Photo Album Plus","packageName":"wp-photo-album-plus","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"8.5.02.005","changes":[{"at":"8.6.01.005","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://patchstack.com/database/vulnerability/wp-photo-album-plus/wordpress-wp-photo-album-plus-plugin-8-5-02-005-ip-bypass-vulnerability?_s_id=cve"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:06:24.729Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/49xxx/CVE-2023-49774.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-49774","state":"PUBLISHED","datePublished":"2024-06-04T11:23:29.421Z","dateUpdated":"2026-04-28T16:08:57.583Z","assignerShortName":"Patchstack","assignerOrgId":"21595511-bba5-4825-b968-b78d1f9984a3","dateReserved":"2023-11-30T13:22:54.825Z"},"containers":{"cna":{"title":"WordPress WP Photo Album Plus plugin <= 8.5.02.005 - IP Bypass vulnerability","descriptions":[{"lang":"en","value":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005."}],"affected":[{"vendor":"J.N. Breetvelt a.k.a. OpaJaap","product":"WP Photo Album Plus","packageName":"wp-photo-album-plus","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"8.5.02.005","changes":[{"at":"8.6.01.005","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://patchstack.com/database/vulnerability/wp-photo-album-plus/wordpress-wp-photo-album-plus-plugin-8-5-02-005-ip-bypass-vulnerability?_s_id=cve","tags":["vdb-entry"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Patchstack","orgId":"21595511-bba5-4825-b968-b78d1f9984a3","dateUpdated":"2026-04-28T16:08:57.583Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Brandon Roldan (Patchstack Alliance)"}],"impacts":[{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update to 8.6.01.005 or a higher version."}],"value":"Update to 8.6.01.005 or a higher version."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"wppa","product":"wp_photo_album_plus","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"8.5.02.005","versionType":"custom"}],"cpes":["cpe:2.3:a:wppa:wp_photo_album_plus:*:*:*:*:*:wordpress:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-04T14:52:40.837597Z","id":"CVE-2023-49774","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-24T15:39:43.697Z"}},{"title":"CVE Program Container","references":[{"url":"https://patchstack.com/database/vulnerability/wp-photo-album-plus/wordpress-wp-photo-album-plus-plugin-8-5-02-005-ip-bypass-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T22:01:25.853Z"}}]}}}