What’s Vulnerable › Vulnerabilities
CVE-2026-18048: WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-12 · updated 2026-08-26
- Weakness: CWE-73
Description
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.
Affected products
- opajaap WP Photo Album Plus: before 9.2.07.002 — fixed in 9.2.07.002
How to fix
Upgrade to a fixed version: opajaap WP Photo Album Plus 9.2.07.002. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-18048 or the next vulnerability affects your stack