WP Photo Album Plus, CVE-2026-18048

CVE, Research URL: CVE-2026-18048
Home page URL: Security reports for WP Photo Album Plus
Application: WP Photo Album Plus
Published on: Aug 12, 2026
Research Description: The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.
Affected versions: max 9.2.07.002.
Status: vulnerable