WP Photo Album Plus CVE-2026-110983

Exploitation requires the WP Photo Album Plus plugin (versions before 9.3.04.004) to be installed, and a specific precondition on the victim side: the lured user must be currently authenticated to WordPress AND hold comment-moderation rights. The concrete flaw is that one of the plugin's comment-management requests validates neither the request origin nor a security (nonce) token, so a cross-site request from an attacker-controlled page is accepted. Limiting factors that reduce real-world risk: it requires active user interaction (the moderator must load the attacker's crafted page while logged in, UI:R), it only affects users with comment-moderation privileges, the impact is limited to deletion of photo comments (no confidentiality or availability loss), and it is not automatable at scale since each attack targets an individual privileged session.

This is a moderate, low-priority issue rather than an urgent one, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable CSRF flaw (CWE-352) with low integrity impact and no confidentiality or availability impact; PR:N reflects that the attacker needs no account of their own, while UI:R correctly captures the dependency on a privileged victim loading a crafted page. The SSVC framework reinforces low urgency: Exploitation=none (no observed exploitation), Automatable=no (each attack needs a specific logged-in moderator to be lured), and Technical Impact=partial. There is no CISA KEV listing and no EPSS score was supplied, so widespread or automated exploitation probability cannot be quantified from this data - but the absence of KEV combined with SSVC Exploitation=none and the non-automatable nature all point the same direction. A PoC reference exists (WPScan) but is not verified as working exploit code, so it should not be read as active exploitation. The vuln.today decision label is 'this_month,' consistent with a real-but-non-emergency fix cadence. Net: a genuine CSRF worth patching in routine cycles, not a high-severity emergency; the only limitation to impact is that it merely deletes photo comments.

An attacker crafts a web page containing a forged comment-management request and lures a WordPress user who holds comment-moderation rights into visiting it while logged in; because the plugin verifies neither request origin nor a security token, the victim's browser silently submits the request and photo comments are deleted. A public PoC reference exists (WPScan) but it is not verified as working exploit code. Exploitation requires that the victim be an authenticated moderator and actively load the malicious page (UI:R), limiting it to targeted social-engineering rather than mass automated attacks.