WP Photo Album Plus < 9.2.07.002 Unauthenticated Sensitive Data Disclosure (CVE-2026-18049)

Vulnerability Overview Vulnerability Name: WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo Description: This plugin does not perform any capability or nonce checks on its public endpoint actions and constructs option names from client-provided values without restricting them to its own options. This allows unauthenticated users to read the values of other auto-loaded options whose names end with a matching suffix. CVE Number: CVE-2026-18049 Classification: - Type: SENSITIVE DATA DISCLOSURE - OWASP Top 10: A3: Sensitive Data Exposure - CWE: CWE-200 - CVSS: 4.8 (medium) Affected Scope Affected Plugin: wp-photo-album-plus Fixed Version: 9.2.07.002 Remediation Fixed Version: Upgrade to wp-photo-album-plus version 9.2.07.002 or higher. Timeline Public Disclosure Date: 2026-08-10 Added Date: 2026-08-10 Last Updated: 2026-08-10 Additional Information Original Researcher: Erwan LR (WPScan) Submitter: Erwan LR (WPScan) Submitter Website: https://wpscan.com Verification Status: Yes WPVDB ID: ee7a93ff-95f2-48f6-9e35-2e518a28e2ab Related Vulnerabilities 2026-01-23: RegistrationMagic <= 6.0.7.2 - Subscriber+ Sensitive Data Disclosure 2024-08-28: Premium SEO Pack - WP SEO Plugin <= 1.6.002 - Unauthenticated Information Exposure 2023-10-12: WP < 6.3.2 - Contributor+ Comment Disclosure 2024-08-12: Bit Form Pro < 2.8.0 - Authenticated (Subscriber+) Sensitive Information Exposure 2023-09-11: WooCommerce < 7.9 - Unauthenticated Sensitive Information Disclosure POC Code

Goal Reached Thanks to every supporter — we hit 100%!

WP Photo Album Plus < 9.2.07.002 Unauthenticated Sensitive Data Disclosure (CVE-2026-18049)

More from this source