CVE-2026-18962

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 9.2.09.002

Description An authorization flaw exists when processing front-end uploads, where the system fails to verify if the current user has permission to upload to the target album. This allows any authenticated user, including those with Subscriber roles, to upload files into albums owned by other users or the administrator. This issue is only exploitable if the front-end user upload feature is enabled.

Recommendations Update to version 9.2.09.002 or later. Disable the front-end user upload feature to mitigate the risk.