What is the CVSS score of CVE-2026-18049?

CVE-2026-18049 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 16.0%.

Which versions of WP Photo Album Plus are affected by CVE-2026-18049?

WP Photo Album Plus plugin contains an unauthenticated information disclosure flaw allowing attackers to extract WordPress configuration secrets from any affected website running versions before…. A patch is available.

Is there a public PoC exploit available for CVE-2026-18049?

Yes, a public proof-of-concept exploit is available for CVE-2026-18049. Prioritise patching immediately. EPSS: 16.0%.

How to fix or mitigate CVE-2026-18049?

Within 24 hours, prioritize updating WP Photo Album Plus to version 9.2.07.002 or later on all affected WordPress installations. Within 7 days, confirm successful deployment across the entire web estate, retrieve and analyze server access logs from the past 30 days for evidence of exploitation attempts targeting the vulnerable endpoint, and identify any unauthorized access patterns. Within 30 days, conduct a complete security review of WordPress options that may have been exposed, rotate all potentially compromised credentials (API keys, authentication tokens, database passwords), and assess whether any third-party integrations were compromised through leaked connection details.

WP Photo Album Plus CVE-2026-18049

EUVD-2026-57096 HIGH

Information Exposure (CWE-200)

2026-08-12 WPScan

GHSA-8pjc-hhvr-vf36

Information Disclosure WordPress Wp Photo Album Plus

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Public unauthenticated network endpoint with no complexity; read-only access to arbitrary option values drives C:H with zero integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 17:27 vuln.today

Patch available

Aug 12, 2026 - 07:16 EUVD

CVE Published

Aug 12, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 12, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.

AnalysisAI

Unauthenticated information disclosure in WP Photo Album Plus (WordPress plugin, all versions before 9.2.07.002) allows any remote attacker to read arbitrary autoloaded WordPress option values by supplying a crafted suffix to a public, unprotected endpoint. The plugin constructs an option name from client-controlled input without restricting it to its own namespace or verifying any capability or nonce, exposing site-wide secrets stored in wp_options. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Send unauthenticated HTTP request to plugin's public action endpoint

Delivery

Supply crafted suffix matching target wp_options key

Exploit

Plugin constructs option name from attacker input without validation

Execution

WordPress returns autoloaded option value in response

Persist

Attacker harvests API keys or credentials

Impact

Leverage stolen secrets for downstream compromise

Access

Send unauthenticated HTTP request to plugin's public action endpoint

Delivery

Supply crafted suffix matching target wp_options key

Exploit

Plugin constructs option name from attacker input without validation

Execution

WordPress returns autoloaded option value in response

Persist

Attacker harvests API keys or credentials

Impact

Leverage stolen secrets for downstream compromise

Vulnerability AssessmentAI

Exploitation	No special conditions are required for exploitation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the threat profile: zero prerequisites for exploitation from the network, no user interaction, and high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker sends a crafted HTTP POST request to the WordPress AJAX endpoint (wp-admin/admin-ajax.php or equivalent) targeting the plugin's unprotected action, supplying a suffix string that matches the tail of a known WordPress option name such as a payment gateway API key or SMTP password. The plugin constructs the full option name, fetches its value from wp_options, and returns it in the response - no authentication, session, or interaction required. …
Remediation	Vendor-released patch: version 9.2.07.002. … Detailed patch versions, workarounds, and compensating controls in full report.