EUVD-2026-57104
GHSA-q3rf-7cjg-vf9x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-exploitable via authenticated subscriber; integrity-only impact from unauthorized album file upload with no confidentiality or availability consequence.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the WP Photo Album Plus WordPress plugin before 9.2.09.002's front-end user upload feature to be enabled, which is not the default.
AnalysisAI
Insufficient authorization in WP Photo Album Plus (all versions before 9.2.09.002) allows any authenticated WordPress user-including low-privilege Subscriber accounts-to upload files into photo albums owned by other users or administrators. The flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin's front-end upload endpoint accepts a caller-supplied album identifier without verifying ownership, enabling cross-user content injection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific conditions must both be true for exploitation to succeed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 Medium score reflects a network-accessible, low-complexity attack requiring only authenticated subscriber-level access with a narrow integrity-only impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or obtains a Subscriber-level WordPress account on a target site running a vulnerable version of WP Photo Album Plus with the front-end upload feature enabled. Using the publicly available POC referenced by WPScan, the attacker crafts an HTTP upload request that specifies an administrator-owned album's ID as the target, bypassing the missing ownership check and depositing arbitrary files into that album without authorization. |
| Remediation | Update WP Photo Album Plus to version 9.2.09.002 or later, which is the confirmed patched release per the WPScan advisory (https://wpscan.com/vulnerability/146079f7-d4e5-4f1e-a715-f681fc33ed6a/) and ENISA EUVD-2026-57104. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Photo Album Plus
View allUnauthenticated information disclosure in WP Photo Album Plus (WordPress plugin, all versions before 9.2.07.002) allows
Unauthenticated arbitrary file deletion in WP Photo Album Plus (versions before 9.2.07.002) exposes WordPress sites to p
Reflected Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions before 9.2.07.002) allows unaut
SQL injection in the WP Photo Album Plus WordPress plugin before 9.1.11.001 allows unauthenticated attackers to inject a
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Rated medium
Stored XSS in WP Photo Album Plus (all versions up to 9.2.03.001) allows unauthenticated remote attackers to inject pers
Unauthenticated SQL injection in the WP Photo Album Plus WordPress plugin (versions ≤ 9.1.08.001) allows remote attacker
Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin
Blind SQL injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.1.13.005) lets remot
The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrendere
Reflected/unauthenticated Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (versions <= 9.2.02.004) lets
The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and i
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today