目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1336 CNY

100%
コーヒーを一杯おごる

CVE-2026-18962— WP Photo Album Plus <9.2.09.002 订阅者越权上传漏洞

AI Predicted 7.6 Difficulty: Easy EPSS 0.13% · P3

Affected Version Matrix 1

ベンダープロダクトVersion Rangeステータス
UnknownWP Photo Album Plus< 9.2.09.002affected
新しい脆弱性情報の通知を購読するログインして購読

I. CVE-2026-18962の基本情報

脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗

高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。

脆弱性タイトル
WP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization
ソース: CVE Program / CVE List V5
脆弱性説明
The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the WP Photo Album Plus WordPress plugin before 9.2.09.002's front-end user upload feature to be enabled, which is not the default.
ソース: CVE Program / CVE List V5
CVSS情報
N/A
ソース: CVE Program / CVE List V5
脆弱性タイプ
N/A
ソース: CVE Program / CVE List V5

影響を受ける製品

ベンダープロダクト影響を受けるバージョンCPE購読
UnknownWP Photo Album Plus 0 ~ 9.2.09.002 -

II. CVE-2026-18962の公開POC

#POC説明ソースリンクShenlongリンク
AI生成POCプレミアム

公開POCは見つかりませんでした。

ログインしてAI POCを生成

III. CVE-2026-18962のインテリジェンス情報

请登录查看更多情报信息。

CVE-2026-18962 厂商安全公告 (1)

Same Patch Batch · Unknown · 2026-08-12 · 44 CVEs total

CVE-2026-167476.5 MEDIUMKirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions
CVE-2026-150456.5 MEDIUMWallet System for WooCommerce < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalid
CVE-2026-170085.3 MEDIUMQuick PayPal Payments <= 5.7.50 - Unauthenticated Payment Bypass via PayPal IPN
CVE-2026-169905.3 MEDIUMPayment Button for PayPal <= 1.2.3.44 - Unauthenticated Payment Price Manipulation
CVE-2026-152135.3 MEDIUMWelcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callba
CVE-2026-166215.3 MEDIUMPayment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via Pay
CVE-2026-180443.7 LOWEstatik Real Estate Plugin < 4.3.4 - Unauthenticated Arbitrary-Recipient Mail Relay via Si
CVE-2026-13613KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint
CVE-2026-16051WPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install Action
CVE-2026-13177Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR
CVE-2026-12976LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant
CVE-2026-13612KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDO
CVE-2026-15249Patterns Kit <= 1.0.3 - Contributor+ Stored XSS via YouTube Popup Link
CVE-2026-15039Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload
CVE-2026-15388Cookie Consent < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure
CVE-2026-16538TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Di
CVE-2026-16066Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name
CVE-2026-16253Total Upkeep (BoldGrid Backup) < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Fo
CVE-2026-16294Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episod
CVE-2026-13171Eventin < 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint

Showing 20 of 44 CVEs. View all on vendor page →

IV. 関連脆弱性

同じ製品: WP Photo Album Plus
同じベンダー: Unknown

V. CVE-2026-18962へのコメント

まだコメントはありません

コメントを残す