CVE-2026-18048: WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18048?
CVE-2026-18048 has a risk score of 54, indicating a moderate severity level.
How do I fix CVE-2026-18048?
To mitigate CVE-2026-18048, update the WP Photo Album Plus plugin to version 9.2.07.002 or later.
What impact does CVE-2026-18048 have on my website?
CVE-2026-18048 allows unauthenticated attackers to delete arbitrary ZIP files from the server, posing a risk to data integrity.
Which versions of the WP Photo Album Plus are affected by CVE-2026-18048?
CVE-2026-18048 affects all versions of WP Photo Album Plus prior to 9.2.07.002.
Is authentication required to exploit CVE-2026-18048?
No, CVE-2026-18048 can be exploited without authentication, allowing attackers to manipulate file paths.