CVE-2026-17014 in Photo Album Plus Plugin

Riassunto

di MITRE • 09/08/2026

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Responsabile: WPScan
• Prenotare: 24/07/2026
• Divulgazione: 09/08/2026
• Moderazione: accettato
• Voce: VDB-387246
• CPE: pronto
• CWE: CWE-73 (confermato)
• CVSS: 7.3 (VulDB)
• EPSS: 0.00145
• KEV: no
• Attività: basso
• Settore: Hostingprovider

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-17014
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-17014
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-17014/