CVE-2026-18962

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the WP Photo Album Plus WordPress plugin before 9.2.09.002's front-end user upload feature to be enabled, which is not the default.

Score

CVSS 3.1 4.3 Medium

Status

Deferred - contact@wpscan.com

Published

2026-08-12

Last modified

2026-08-12

Weaknesses

CWE-639

Affected products

• Wp Photo Album Plus (Unknown)

References

• https://wpscan.com/vulnerability/146079f7-d4e5-4f1e-a715-f681fc33ed6a/