CVE-2026-18049: high-severity vulnerability in WP Photo Album Plus
WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo
Published
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.5epss 0.4%
exploitation probability
0.4%top 64% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Unknown · WP Photo Album Pluspublic PoCs found — 1
cve_referencewpscan.com/vulnerability/ee7a93ff-95f2-48f6-9e35-2e518a28e2ab/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — WP Photo Album Plus
In the same product, most dangerous first.
CVE-2021-25115—WP Photo Album Plus < 8.0.10 - Stored Cross-Site Scripting (XSS)EPSS 0.7%CVE-2026-6379HIGHWP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' ParameterEPSS 0.4%CVE-2026-18048HIGHWP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path TraversalEPSS 0.4%CVE-2026-17014MEDIUMWP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzipsEPSS 0.3%CVE-2026-17013MEDIUMWP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstartEPSS 0.3%CVE-2026-18962MEDIUMWP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing AuthorizationEPSS 0.3%