Vulnerability · Published Aug 12, 2026 · Assigned by WPScan

CVE-2026-18962WP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in WP Photo Album Plus from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 82.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the WP Photo Album Plus WordPress plugin before 9.2.09.002's front-end user upload feature to be enabled, which is not the default.

Affected products (as reported)

Vendor	Product	Versions
Unknown	WP Photo Album Plus	0 – before 9.2.09.002

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://wpscan.com/vulnerability/146079f7-d4e5-4f1e-a715-f681fc33ed6a/ exploit, vdb-entry, technical-description