CVE-2026-18049

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 9.2.07.002

Description An issue exists where the plugin fails to perform capability or nonce checks on a public endpoint action. The software constructs an option name using a client-supplied value without restricting it to its own options. This allows unauthenticated users to read the values of other autoloaded options that end with a matching suffix.

Recommendations Update WP Photo Album Plus to version 9.2.07.002 or later.