CVE-2026-17014: WP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzips
Published Aug 9, 2026
·Updated
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores.
Affected Software
1 affected component
WP Photo Album Plus<9.2.07.002
Event History
Aug 9, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:18 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-17014?
The severity of CVE-2026-17014 is rated as 28.
2
How do I fix CVE-2026-17014?
To fix CVE-2026-17014, update the WP Photo Album Plus plugin to version 9.2.07.002 or later.
3
What type of vulnerability is CVE-2026-17014?
CVE-2026-17014 is an unauthenticated export ZIP file deletion vulnerability.
4
What affects CVE-2026-17014?
CVE-2026-17014 affects WP Photo Album Plus WordPress plugin versions prior to 9.2.07.002.
5
Can unauthenticated users exploit CVE-2026-17014?
Yes, unauthenticated users can exploit CVE-2026-17014 to delete generated album export ZIP archives.