CVE-2026-17014 in Photo Album Plus Plugin
Summary
by MITRE • 08/09/2026
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/09/2026
The WP Photo Album Plus WordPress plugin vulnerability represents a critical access control flaw that undermines the security posture of affected WordPress installations. This issue affects versions prior to 9.2.07.002 and stems from inadequate authentication mechanisms within the plugin's REST API endpoints. The vulnerability specifically targets one public endpoint action that should require proper capability verification and nonce validation but fails to implement these essential security controls. Attackers can exploit this weakness to execute unauthorized deletion operations on album export ZIP archives that the plugin generates and stores within the system.
The technical exploitation of this vulnerability occurs through the WordPress REST API framework where the plugin exposes functionality without proper authorization checks. The absence of capability verification means that any unauthenticated user can access the vulnerable endpoint and trigger archive deletion operations. Additionally, the lack of nonce validation removes another critical layer of protection that would normally prevent CSRF attacks and ensure that requests originate from legitimate sources within the WordPress environment. This combination of missing security controls creates an attack surface where malicious actors can manipulate the plugin's storage system without requiring any valid credentials or privileged access.
The operational impact of this vulnerability extends beyond simple data loss, as it enables attackers to disrupt the normal operation of photo gallery functionalities and potentially cause service degradation. When album export ZIP archives are deleted, users lose access to their generated content which may include multiple images organized into galleries. This can result in significant data recovery challenges for administrators who rely on these exports for backup purposes or for sharing photo collections with others. The vulnerability also represents a potential denial of service vector where repeated deletion attempts could systematically remove all export archives, effectively breaking the plugin's export functionality entirely.
Security practitioners should view this vulnerability through the lens of CWE-863, which addresses "Incorrect Authorization" issues in software systems. The flaw aligns with ATT&CK technique T1078.004, which covers "Valid Accounts: Cloud Accounts" and represents how attackers can leverage weak access controls to compromise system integrity. Organizations running affected versions should immediately implement mitigations including immediate plugin updates to version 9.2.07.002 or later, which contains the necessary authorization and nonce validation patches. Additional defensive measures include implementing network-level restrictions on REST API endpoints, monitoring for unusual deletion patterns in plugin storage directories, and ensuring that WordPress core and all plugins remain current with security releases. The vulnerability also highlights the importance of proper input validation and access control implementation within WordPress plugins, particularly those handling user-generated content or system resources that could be targeted by unauthorized operations.
This type of vulnerability demonstrates how seemingly minor oversights in authentication implementation can create significant security risks within content management systems. The affected plugin's failure to properly validate user privileges on public endpoints exposes sensitive system functionality to unauthorized manipulation, emphasizing the critical need for comprehensive security testing of all API interactions within WordPress plugins. Organizations should conduct thorough security reviews of their plugin ecosystems to identify similar authorization gaps and implement robust access control measures that align with industry best practices for REST API security.