CVE-2026-18962

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the WP Photo Album Plus WordPress plugin before 9.2.09.002's front-end user upload feature to be enabled, which is not the default.

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.15% chance of exploitation in the next 30 days, 5th percentile

Published

2026-08-12

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/146079f7-d4e5-4f1e-a715-f681fc33ed6a/

References

• CVE Record
• NVD entry

Related

• CVE-2026-18960
• CVE-2026-18963
• CVE-2026-18959
• CVE-2026-18968
• CVE-2026-18958
• CVE-2026-18969