CVE-2024-8988: PeepSo Core WordPress Plugin IDOR Vulnerability

CVE-2024-8988 Overview

CVE-2024-8988 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the PeepSo Core: File Uploads plugin for WordPress. The flaw affects all versions up to and including 6.4.6.0. The file_download REST API endpoint fails to validate a user-controlled key. Unauthenticated attackers can enumerate and download files uploaded by other users. This exposes potentially sensitive information stored through the community plugin.

Critical Impact
Unauthenticated remote attackers can retrieve arbitrary user-uploaded files over the network without any prior access or user interaction.

Affected Products

PeepSo Core: File Uploads plugin for WordPress (all versions ≤ 6.4.6.0)
WordPress sites running the PeepSo community suite with file upload functionality enabled
Multisite WordPress deployments where the vulnerable plugin is network-activated

Discovery Timeline

2025-05-14 - CVE-2024-8988 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8988

Vulnerability Analysis

The vulnerability resides in the file_download REST API endpoint exposed by the PeepSo Core: File Uploads plugin. The endpoint accepts a user-controlled identifier that references a stored upload but does not verify that the requester is authorized to access the referenced object. An attacker can supply arbitrary identifiers and retrieve files belonging to other users.

Because the endpoint requires no authentication, exploitation reduces to iterating over file identifiers and issuing HTTP requests. The impact scope depends on what community members upload through PeepSo, including attachments in private groups, profile documents, or direct messages.

Root Cause

The root cause is missing access control on a direct object reference [CWE-639]. The endpoint trusts a client-supplied key to identify the target file and returns the resource without checking session state, ownership, or group membership. This pattern violates the principle of authorization checks at every request boundary.

Attack Vector

Exploitation occurs over the network with low attack complexity and no privileges or user interaction. An attacker sends crafted HTTP requests to the WordPress REST API route registered by the plugin, substituting file identifiers to retrieve unauthorized content. Automated enumeration can harvest large volumes of uploaded material from a vulnerable site. Refer to the Wordfence Vulnerability Report for additional technical detail on the affected endpoint.

Detection Methods for CVE-2024-8988

Indicators of Compromise

Repeated unauthenticated requests to WordPress REST routes containing file_download in the path
Sequential or enumerated identifier values in query parameters targeting the PeepSo endpoint
Bursts of HTTP 200 responses returning binary or document Content-Type values to a single source IP
Access log entries from user agents associated with scraping tools targeting /wp-json/ endpoints

Detection Strategies

Review WordPress and web server access logs for anonymous access patterns against the PeepSo file_download route
Alert on high request rates against /wp-json/peepso/ endpoints originating from unauthenticated sessions
Correlate outbound file transfer volume from the WordPress host against baseline traffic to identify mass extraction

Monitoring Recommendations

Enable verbose logging for REST API requests handled by the PeepSo plugin and forward logs to a central SIEM
Track the version of the PeepSo Core: File Uploads plugin across managed WordPress instances
Monitor the PeepSo Changelog for further security-relevant releases

How to Mitigate CVE-2024-8988

Immediate Actions Required

Update the PeepSo Core: File Uploads plugin to a version later than 6.4.6.0 as published in the vendor changelog
Audit the WordPress uploads directory and PeepSo attachment storage for evidence of unauthorized retrieval
Rotate any credentials, tokens, or personal data that may have been exposed through community uploads

Patch Information

The vendor addressed the missing authorization check in a subsequent release tracked in the PeepSo Changelog. Administrators should apply the fixed version through the WordPress plugin manager and confirm the running version matches the patched release.

Workarounds

Deactivate the PeepSo Core: File Uploads plugin until the patched version is installed
Restrict access to /wp-json/peepso/ routes through a Web Application Firewall rule while the patch is being validated
Require authentication at the reverse proxy for REST API paths that do not need to serve anonymous traffic

bash

# Example WAF rule to block unauthenticated PeepSo file_download requests
# Adapt to your WAF syntax (ModSecurity example)
SecRule REQUEST_URI "@rx /wp-json/peepso/.*/file_download" \
  "id:1008988,phase:1,deny,status:403,\
   msg:'CVE-2024-8988 PeepSo file_download IDOR block',\
   chain"
  SecRule &REQUEST_HEADERS:Cookie "@eq 0"