CVE-2026-17014
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The WP Photo Album Plus WordPress plugin before version 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores.
Risk Assessment
The risk includes the possibility of deleting important data (export archives) by unauthenticated attackers, which may lead to data loss and disruption of operations.
Recommendation
It is recommended to immediately update the WP Photo Album Plus plugin to version 9.2.07.002 or later, which includes the security fix.
Original NVD description (English source)
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores.