CVE-2026-18962

CVE-2026-18962 affects the WP Photo Album Plus WordPress plugin before 9.2.09.002 . The issue is that the plugin does not verify that the current user is authorized to upload into the target album during a front-end upload, allowing any authenticated user (such as a Subscriber) to upload files in...

CVE-2026-18962 WP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...