WP Photo Album Plus, CVE-2026-18049
- CVE, Research URL
- Home page URL
- Application
- Published on
- Aug 12, 2026
- Research Description
- The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.
- Affected versions
-
max 9.2.07.002.
- Status
-
vulnerable