What is the CVSS score of EUVD-2026-57095?

EUVD-2026-57095 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 16.0%.

Which versions of WP Photo Album Plus are affected by EUVD-2026-57095?

WP Photo Album Plus WordPress plugin versions prior to 9.2.07.002 contain an unauthenticated arbitrary file deletion vulnerability with publicly available exploit code.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-57095?

Yes, a public proof-of-concept exploit is available for EUVD-2026-57095. Prioritise patching immediately. EPSS: 16.0%.

How to fix or mitigate EUVD-2026-57095?

Within 24 hours, inventory all WordPress installations running WP Photo Album Plus and identify those below version 9.2.07.002; prioritize production environments and sites storing sensitive data. Within 7 days, deploy the vendor-released patch to version 9.2.07.002 across all affected installations, beginning with the highest-risk systems. Within 30 days, verify complete patch deployment across your WordPress portfolio, conduct file integrity audits to identify unauthorized deletions, and review server logs spanning the previous 90 days for exploitation indicators.

WP Photo Album Plus EUVD-2026-57095

| CVE-2026-18048 HIGH

External Control of File Name or Path (CWE-73)

2026-08-12 WPScan

GHSA-7qh7-857w-wvvg

WordPress Information Disclosure Wp Photo Album Plus Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

8.2 HIGH

PR:N confirmed by public endpoint with no auth check; A:L added over NVD's A:N because deleting server-side ZIP archives disrupts backup and deployment processes.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 20:36 vuln.today

CVSS changed

Aug 12, 2026 - 20:22 NVD

7.5 (HIGH)

Patch available

Aug 12, 2026 - 07:16 EUVD

CVE Published

Aug 12, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 12, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.

AnalysisAI

Unauthenticated arbitrary file deletion in WP Photo Album Plus (versions before 9.2.07.002) exposes WordPress sites to path traversal attacks through a public endpoint that accepts unvalidated client-controlled file path values with no authorization check in place. Any remote unauthenticated attacker can manipulate this path parameter to target and delete ZIP archives stored anywhere on the server, including directories outside the web root. A publicly available proof-of-concept exists, EPSS scores this at 16%, and no public exploit identified at time of analysis maps to confirmed mass exploitation - but the low attack complexity and zero authentication barrier make rapid weaponization realistic.

Technical ContextAI

The vulnerability is classified as CWE-73 (External Control of File Name or Path), a root cause where application logic accepts user-supplied input to construct filesystem paths without adequate sanitization or canonicalization. The affected component is a public-facing endpoint action within the WP Photo Album Plus WordPress plugin (CPE: cpe:2.3:a:unknown:wp_photo_album_plus:*:*:*:*:*:*:*:*), which handles ZIP archives as part of its photo album management workflow. Because the path value is not validated against an allowlist or normalized to strip directory traversal sequences, an attacker can supply a crafted value that resolves to an arbitrary server location. The complete absence of any authorization check compounds the severity - no WordPress nonce, capability check, or session credential is required to invoke the deletion action, making this exploitable by any unauthenticated HTTP client.

RemediationAI

Update WP Photo Album Plus to version 9.2.07.002 or later, which is the vendor-released patched version confirmed by the WPScan advisory at https://wpscan.com/vulnerability/fbc145d3-a582-4975-bc6b-e56e633e51e6/; administrators should apply this update immediately via the WordPress admin dashboard or WP-CLI ('wp plugin update wp-photo-album-plus'). If immediate patching is not feasible, a compensating control is to block access to the vulnerable public endpoint at the web server or WAF layer by denying requests to the specific action parameter associated with the file deletion functionality - note this will break the affected plugin feature and may require testing against production behavior. Additionally, relocate any sensitive ZIP archives (backups, deployment packages) to filesystem paths that the web server process user does not have write or delete permission over, and review web server process privilege levels to enforce least-privilege. Server-side file integrity monitoring (e.g., AIDE or equivalent) targeting ZIP archive locations can provide detection of exploitation attempts.