WordPress WP Maps plugin < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation vulnerability

Subscriber+ Unlimited Autoloaded Option Creation vulnerability discovered by Xanlar Agamalizade in WordPress Plugin WP Maps versions 4.9.8...

CVE-2026-18049

The WP Photo Album Plus WordPress plugin, in versions prior to 9.2.07.002 , is vulnerable to an unauthenticated option disclosure via the gettogo endpoint. The flaw exists because the plugin fails to perform capability or nonce checks on a public endpoint action and constructs an option name usin...

CVE-2026-18049 WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of oth...

PT-2026-71021

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of oth...

CVE-2026-18049: Exposure of Sensitive Information to an Unauthorized Actor

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of oth...