CVE-2023-49812: 
WordPress vulnerability analysis and mitigation

The CVE-2023-49812 vulnerability affects the WP Photo Album Plus WordPress plugin, versions up to and including 8.5.02.005. This security flaw is classified as an Authorization Bypass Through User-Controlled Key vulnerability, which was discovered and reported on December 5, 2023 (Patchstack).

The vulnerability is classified as an Insecure Direct Object Reference (IDOR) issue, falling under the OWASP Top 10 category A5: Broken Access Control and CWE-639. It has received varying CVSS scores, with the NVD assigning a HIGH severity score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), while Patchstack rates it as MEDIUM with a score of 5.3 (NVD, WPScan).

The vulnerability allows unauthenticated attackers to perform unauthorized actions based on a user-controlled key due to missing validation. This could potentially lead to authorization bypass and access to sensitive information (Patchstack).

The vulnerability has been fixed in version 8.6.01.003 of the WP Photo Album Plus plugin. Users are advised to update to this version or later to remove the vulnerability. The security issue is considered to have a low severity impact and is unlikely to be exploited (Patchstack).