VULNERABILITY INTELLIGENCE
CVE-2026-17014
CVSS score5.3 MEDIUM
EPSS probability0.32%
CISA KEVNot currently listed
Published2026-08-09
Last modified2026-08-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Description
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-73