What is the CVSS score of EUVD-2026-57096?

EUVD-2026-57096 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 16.0%.

Which versions of WP Photo Album Plus are affected by EUVD-2026-57096?

WP Photo Album Plus plugin contains an unauthenticated information disclosure flaw allowing attackers to extract WordPress configuration secrets from any affected website running versions before…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-57096?

Yes, a public proof-of-concept exploit is available for EUVD-2026-57096. Prioritise patching immediately. EPSS: 16.0%.

How to fix or mitigate EUVD-2026-57096?

Within 24 hours, prioritize updating WP Photo Album Plus to version 9.2.07.002 or later on all affected WordPress installations. Within 7 days, confirm successful deployment across the entire web estate, retrieve and analyze server access logs from the past 30 days for evidence of exploitation attempts targeting the vulnerable endpoint, and identify any unauthorized access patterns. Within 30 days, conduct a complete security review of WordPress options that may have been exposed, rotate all potentially compromised credentials (API keys, authentication tokens, database passwords), and assess whether any third-party integrations were compromised through leaked connection details.

WP Photo Album Plus EUVD-2026-57096

| CVE-2026-18049 HIGH

Information Exposure (CWE-200)

2026-08-12 WPScan

GHSA-8pjc-hhvr-vf36

WordPress Information Disclosure Wp Photo Album Plus Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Public unauthenticated network endpoint with no complexity; read-only access to arbitrary option values drives C:H with zero integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 17:27 vuln.today

Patch available

Aug 12, 2026 - 07:16 EUVD

CVE Published

Aug 12, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 12, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.

AnalysisAI

Unauthenticated information disclosure in WP Photo Album Plus (WordPress plugin, all versions before 9.2.07.002) allows any remote attacker to read arbitrary autoloaded WordPress option values by supplying a crafted suffix to a public, unprotected endpoint. The plugin constructs an option name from client-controlled input without restricting it to its own namespace or verifying any capability or nonce, exposing site-wide secrets stored in wp_options. A publicly available proof-of-concept exists, SSVC rates this as automatable with partial technical impact, and EPSS sits at 16%, indicating meaningful real-world exploitation interest despite the absence of a CISA KEV listing.

Technical ContextAI

WordPress stores plugin and site-wide configuration in the wp_options table; rows marked autoloaded=yes are loaded into memory on every page request and frequently contain sensitive data such as API keys, OAuth tokens, secret salts, and third-party integration credentials. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) is the root cause: the plugin registers a public AJAX or REST-style action endpoint that accepts a user-supplied string, appends or prepends it to form an option name, then queries and returns the stored value. Because no capability check (current_user_can()) and no nonce verification are applied, this endpoint is fully accessible to unauthenticated HTTP clients. Affected product scope per CPE cpe:2.3:a:unknown:wp_photo_album_plus:*:*:*:*:*:*:*:* covers all versions up to but not including 9.2.07.002.

RemediationAI

Vendor-released patch: version 9.2.07.002. Update the WP Photo Album Plus plugin immediately via the WordPress admin dashboard or by downloading the patched release directly. The WPScan advisory (https://wpscan.com/vulnerability/ee7a93ff-95f2-48f6-9e35-2e518a28e2ab/) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-18049) document the fix. If immediate patching is not possible, a compensating control is to use a WAF rule to block requests to the vulnerable public endpoint - identify the specific action parameter name from the WPScan advisory and block requests containing it at the edge. Note that this workaround may break legitimate plugin functionality. Additionally, audit your WordPress site's autoloaded options for exposed secrets and rotate any API keys or tokens that could have been read if exploitation occurred before patching.