CVE-2026-18049
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.
Risk Assessment
An unauthenticated attacker can access sensitive configuration options, potentially leading to data leakage or further attacks.
Recommendation
Update the WP Photo Album Plus plugin to version 9.2.07.002 or later. Add capability and nonce checks to public actions and restrict option names to its own.
Original NVD description (English source)
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.