PeepSo Core File Uploads Insecure Direct Object Reference Vulnerability Allowing Unauthenticated Sensitive Information Exposure

A vulnerability exists in the PeepSo Core: File Uploads plugin for WordPress, in all versions through 6.4.6.0. The issue is an Insecure Direct Object Reference (IDOR) that allows unauthenticated attackers to access files uploaded by other users through the file_download REST API endpoint. This vulnerability arises from inadequate validation of user-controlled keys, potentially leading to the exposure of sensitive information.

Impact

Exploitation of this vulnerability could result in unauthorized access to files uploaded by other users, potentially exposing sensitive information.

Remediation

Users can update to version 6.4.6.1 or a newer patched version to address this vulnerability.