2 matches found
CVE-2026-18049
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of oth...
5.3AI score0.0028EPSS
SaveExploits0References1
CVE-2026-18049 WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of oth...
0.0028EPSS
SaveExploits0References1
20