WP Photo Album Plus lets Subscribers upload into others' albums
WP Photo Album Plus before 9.2.09.002 allows wppa_user_upload() to process the request's upload-album value after checking only that the non-default front-end user-upload feature is enabled and the requester is logged in. A Subscriber can target an album owned by another user or an Administrator, and downstream processing writes the file and photo entry there. File types and consequences remain constrained by the plugin's normal upload pipeline and site settings; code execution is not disclosed.
- Component
- WP Photo Album Plus
- Plugin slug
wp-photo-album-plus- Affected
- < 9.2.09.002
- Safe version
9.2.09.002- Published
- Aug 12, 2026
This CVE was published Aug 12, 2026 and is one of 27 known issues for this plugin.
Update, patch or deactivate.
Update to 9.2.09.002 or later. Until updated, disable front-end user uploads. Review albums for unexpected files and remove untrusted uploads.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the WP Photo Album Plus WordPress plugin before 9.2.09.002's front-end user upload feature to be enabled, which is not the default.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N