CVE-2026-18048

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 9.2.07.002

Description An issue exists where a public endpoint action fails to validate a client-controlled value used to construct a file path and lacks authorization checks. This allows unauthenticated attackers to delete arbitrary ZIP archives on the server, including files located outside the web root, via a path traversal attack in the delmyzip action.

Recommendations Update WP Photo Album Plus to version 9.2.07.002 or later.