CVE-2026-17014 in Photo Album Plus Plugin

الملخص

بحسب MITRE • 09/08/2026

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• مسؤول: WPScan
• حجز: 24/07/2026
• إفشاء: 09/08/2026
• الاعتدال: تمت الموافقة
• إدخال: VDB-387246
• CPE: جاهز
• CWE: CWE-73 (مؤكد)
• CVSS: 7.3 (VulDB)
• EPSS: 0.00000
• KEV: لا
• النشاطات: منخفض
• القطاع: Hostingprovider

المصادر

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-17014
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-17014
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-17014/