WP Photo Album Plus delmyzip permits unauthenticated file deletion
WP Photo Album Plus before 9.2.07.002 exposes wppa_ajax_callback() through wp_ajax_nopriv_wppa and the REST route /wp-photo-album-plus/endPoint/. Its delmyzip action builds a .zip path from WPPA_UPLOAD_PATH, the zips directory and wppa_get_user(), then deletes it without authentication or a nonce. For logged-out users, wppa_get_user() derives a value from client-IP and forwarded-address helpers, providing the client-controlled path component described by WPScan. Traversal can delete arbitrary .zip files, including outside the web root. The accepted header and filesystem prerequisites depend on the deployment.
- Component
- WP Photo Album Plus
- Plugin slug
wp-photo-album-plus- Affected
- < 9.2.07.002
- Safe version
9.2.07.002- Published
- Aug 12, 2026
This CVE was published Aug 12, 2026 and is one of 27 known issues for this plugin.
Update, patch or deactivate.
Update to 9.2.07.002 or later. Review public wppa and REST requests, restore deleted archives from a known-good backup, and inspect trusted-proxy handling of client-address headers.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N