Beveiligingsadvies

CVE-2026-18962

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-08-12 06:00:18

Laatst bijgewerkt 2026-08-12 12:28:17

Toegewezen door WPScan

CVSS-score 4.3

Status PUBLISHED

Beschrijving

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the WP Photo Album Plus WordPress plugin before 9.2.09.002's front-end user upload feature to be enabled, which is not the default.

← Alle CVE's bekijken Bekijk op cve.org ↗