CVE-2026-18962
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when processing a front-end upload. This allows any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the plugin's front-end user upload feature to be enabled, which is not the default.
Risk Assessment
A low-privileged user can place malicious files in other users' or administrator's albums, potentially leading to malware distribution or data integrity compromise.
Recommendation
Update the WP Photo Album Plus plugin to version 9.2.09.002 or later. If the front-end upload feature is not needed, disable it.
Original NVD description (English source)
The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the WP Photo Album Plus WordPress plugin before 9.2.09.002's front-end user upload feature to be enabled, which is not the default.