CVE-2026-110983: WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF
The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using WP Photo Album Plus versions earlier than 9.3.04.004 are exposed when a user with photo-comment moderation rights is logged in and can be induced to load an attacker-controlled crafted page.
What does an attacker need to do to exploit it?
The attacker must trick a logged-in user who has comment-moderation rights into visiting or loading a crafted page. The vulnerable comment-management request lacks origin verification and a security token.
What is the impact of successful exploitation?
An attacker can cause photo comments to be deleted through the authenticated moderator's session.
What should be updated?
Update WP Photo Album Plus to version 9.3.04.004 or later.