What is the CVSS score of CVE-2026-17014?

CVE-2026-17014 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-17014?

Yes, a patch is available for CVE-2026-17014. Update the affected software to the latest version immediately.

WP Photo Album Plus CVE-2026-17014

EUVD-2026-54893 MEDIUM

External Control of File Name or Path (CWE-73)

2026-08-09 contact@wpscan.com

GHSA-v9qq-4jqv-3fxp

WordPress Information Disclosure

5.3

CVSS 3.1 · Vendor: wpscan

Severity by source

Vendor (wpscan) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

6.5 MEDIUM

File deletion impacts both integrity (unauthorized removal of stored data) and availability (those archives become inaccessible), warranting A:L over the official A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (wpscan).

CVSS VectorVendor: wpscan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:23 vuln.today

CVSS changed

Aug 11, 2026 - 20:22 NVD

5.3 (MEDIUM)

Patch available

Aug 09, 2026 - 07:16 EUVD

CVE Published

Aug 09, 2026 - 06:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 09, 2026 - 06:18 cve.org

MEDIUM 5.3

DescriptionCVE.org

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores.

AnalysisAI

Unauthenticated file deletion in WP Photo Album Plus WordPress plugin (all versions before 9.2.07.002) exposes a public REST endpoint that performs no capability or nonce verification, permitting any remote actor to delete generated album export ZIP archives stored by the plugin. The CVSS 3.1 score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N reflecting zero authentication and trivial access requirements, though impact is scoped only to those regenerable archive files. No public exploit or CISA KEV listing exists; EPSS at 0.14% (4th percentile) confirms negligible current exploitation activity.

Technical ContextAI

WP Photo Album Plus is a WordPress photo management plugin that generates ZIP archives of album exports and persists them on the server filesystem. WordPress REST endpoints are designed to be protected by two independent controls: capability checks (asserting the calling user holds a required WordPress role or permission) and nonce tokens (a CSRF mitigation ensuring requests originate from an authorized session). This plugin exposes at least one public REST endpoint action that omits both controls entirely, reducing authorization to zero. The root cause is CWE-73 (External Control of File Name or Path), where an externally supplied HTTP request drives a server-side file operation - in this case deletion - without any validation of caller identity or request legitimacy. Affected product per EUVD-2026-54893: WP Photo Album Plus, all releases from version 0 up to (not including) 9.2.07.002.

RemediationAI

Update WP Photo Album Plus to version 9.2.07.002 or later, which is confirmed as available per the WPScan advisory at https://wpscan.com/vulnerability/d45c05bb-9c9f-4ed0-b02e-f683a56ba0e1/. If immediate patching is not feasible, restrict unauthenticated access to the WordPress REST API at the web server or WAF layer - for example, via an Nginx location block or Apache rewrite rule targeting the specific endpoint path - though this may break other REST-dependent integrations or themes. A narrower compensating control is to temporarily disable the album export feature within the plugin's own settings, which eliminates the attack surface without disrupting the broader REST API. Neither workaround substitutes for the vendor patch.