Secunia

Some vulnerabilities have been reported in the DM Albums plugin for WordPress, which can be exploited by malicious users to bypass certain security restrictions, and by malicious people to bypass certain security restrictions and conduct cross-site scripting attacks.

1) The plugin does not properly restrict access to the dm-albums/wp-dm-albums-ajax.php script. This can be exploited to e.g. delete album folders by calling the script directly.

2) Input passed to the "delete_album" parameter in dm-albums/wp-dm-albums-ajax.php is not properly sanitised before being used to delete album folders. This can be exploited to delete folders outside of the albums root folder via directory traversal attacks.

3) The plugin allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. delete album folders when a logged-in user visits a malicious web site.

Solution
Update to version 2.3.1.

Provided and/or discovered by
1, 2) safety
3) Reported by an anonymous person.

Changelog
Further details available in Customer Area

Original Advisory
http://blog.ndarkness.com/blog/225/wordpress-dm-albums-version-2-0-critical-vulnerability/

http://www.dutchmonkey.com/?label=Latest+News+%26+Announcements#20091022

Deep Links
Links available in Customer Area