CVE-2024-10958 is a high-severity code injection vulnerability in the WP Photo Album Plus WordPress plugin (versions up to 8.8.08.007). The vulnerability arises because the getshortcodedrenderedfenodelay AJAX action allows unauthenticated users to execute arbitrary shortcodes without proper input validation before invoking do_shortcode. This improper control of code generation (CWE-94) can lead to unauthorized code execution within the WordPress environment. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, impacting confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation allows unauthenticated attackers to execute arbitrary shortcodes on the affected WordPress site, potentially leading to unauthorized code execution. This can compromise the confidentiality, integrity, and availability of the site and its data. The CVSS score of 7.3 reflects a high severity impact. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting access to the vulnerable AJAX action if possible. Monitor official channels from the plugin vendor (opajaap) for updates and apply patches promptly once available.