CVE-2026-18962: WP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization
The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the WP Photo Album Plus WordPress plugin before 9.2.09.002's front-end user upload feature to be enabled, which is not the default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Photo Album Plus WordPress pluginto a version that resolves this vulnerability.Fixed in 9.2.09.002 - Configuration
Ensure the plugin’s front-end user upload feature is disabled for non-admin users (exploitation requires the feature to be enabled; it is not the default).
WP Photo Album Plus WordPress plugin front-end user upload feature = disabled (until upgraded)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18962?
CVE-2026-18962 has a risk score of 38, indicating a moderate level of severity due to improper authorization.
How do I fix CVE-2026-18962?
To fix CVE-2026-18962, update the WP Photo Album Plus plugin to version 9.2.09.002 or later.
Who is affected by CVE-2026-18962?
CVE-2026-18962 affects all users of the WP Photo Album Plus plugin prior to version 9.2.09.002.
What types of files can be uploaded due to CVE-2026-18962?
CVE-2026-18962 allows any authenticated user to upload various types of files into albums owned by other users.
Is there a workaround for CVE-2026-18962 if I can't update immediately?
If you cannot update immediately, consider restricting user roles or disabling the uploading feature until a patch is applied.