CVE-2026-18049: unknown wp photo album plus
Vulnerability summary
CVE-2026-18049 is a high (CVSS 7.5) vulnerability in unknown wp photo album plus. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.2% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 9.2.07.002.
Timeline
- 12-08-2026PublishedVulnerability first disclosed.
- 12-08-2026Last modifiedVulnerability information updated.
Description
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- wordfenceSource5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
+0.15 pp
From 0.28% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Unknown1 product
- wp photo album plus< 9.2.07.002
Wordpress1 product
- wp-photo-album-plus< 9.2.07.002
2 vendors · 2 products