EUVD-2026-57095
GHSA-7qh7-857w-wvvg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
PR:N confirmed by public endpoint with no auth check; A:L added over NVD's A:N because deleting server-side ZIP archives disrupts backup and deployment processes.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
5DescriptionCVE.org
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.
AnalysisAI
Unauthenticated arbitrary file deletion in WP Photo Album Plus (versions before 9.2.07.002) exposes WordPress sites to path traversal attacks through a public endpoint that accepts unvalidated client-controlled file path values with no authorization check in place. Any remote unauthenticated attacker can manipulate this path parameter to target and delete ZIP archives stored anywhere on the server, including directories outside the web root. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond the plugin being installed and active on a WordPress site - this is remote unauthenticated exploitation confirmed by CVSS:3.1/AV:N/AC:L/PR:N/UI:N, meaning no WordPress login, nonce, or capability is checked. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) correctly captures the zero-authentication, low-complexity attack profile, though the A:N metric may understate real-world impact since deleting ZIP archives outside the web root - including backup archives or deployment packages - can indirectly cause service disruption and data loss beyond what 'no availability impact' implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running a vulnerable version of WP Photo Album Plus, then issues a crafted HTTP request to the plugin's public endpoint with a path traversal payload (e.g., directory traversal sequences in the file path parameter) targeting a known or guessed ZIP archive stored outside the web root - such as a backup archive or deployment package. The server processes the request without validation or authorization, deletes the targeted file, and returns a response confirming the action. … |
| Remediation | Update WP Photo Album Plus to version 9.2.07.002 or later, which is the vendor-released patched version confirmed by the WPScan advisory at https://wpscan.com/vulnerability/fbc145d3-a582-4975-bc6b-e56e633e51e6/; administrators should apply this update immediately via the WordPress admin dashboard or WP-CLI ('wp plugin update wp-photo-album-plus'). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations running WP Photo Album Plus and identify those below version 9.2.07.002; prioritize production environments and sites storing sensitive data. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Photo Album Plus
View allUnauthenticated information disclosure in WP Photo Album Plus (WordPress plugin, all versions before 9.2.07.002) allows
Reflected Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions before 9.2.07.002) allows unaut
SQL injection in the WP Photo Album Plus WordPress plugin before 9.1.11.001 allows unauthenticated attackers to inject a
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Rated medium
Stored XSS in WP Photo Album Plus (all versions up to 9.2.03.001) allows unauthenticated remote attackers to inject pers
Unauthenticated SQL injection in the WP Photo Album Plus WordPress plugin (versions ≤ 9.1.08.001) allows remote attacker
Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin
Insufficient authorization in WP Photo Album Plus (all versions before 9.2.09.002) allows any authenticated WordPress us
Blind SQL injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.1.13.005) lets remot
The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrendere
Reflected/unauthenticated Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (versions <= 9.2.02.004) lets
The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and i
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today