CVE-2024-4194 is a code injection vulnerability (CWE-94) in the essentialplugin Album and Image Gallery Plus Lightbox WordPress plugin. The flaw arises because the plugin improperly controls the generation of code by failing to validate input before executing do_shortcode, enabling unauthenticated attackers to run arbitrary shortcodes. This affects all versions up to and including 2.0. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No known exploits are currently reported in the wild, and no patch or official fix has been documented.

Successful exploitation allows unauthenticated attackers to execute arbitrary shortcodes, potentially leading to limited confidentiality and integrity impacts within the WordPress environment. There is no indication of availability impact. The vulnerability could be leveraged to perform unauthorized actions within the context of the plugin but does not inherently allow full system compromise based on the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor official vendor channels for updates and apply patches promptly once available.