Comment Management Vulnerability in WP Photo Album Plus Plugin
CVE-2026-110983
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 29 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-110983?
A flaw in the WP Photo Album Plus WordPress plugin prior to version 9.3.04.004 enables an attacker to exploit comment management features. By tricking a logged-in user with moderation rights into accessing a specially crafted page, attackers can potentially delete photo comments without authorization. This vulnerability arises due to the lack of validation for the origin of certain comment-management requests, posing significant risks to the integrity of user-generated content.
Affected Version(s)
WP Photo Album Plus 0 < 9.3.04.004
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.