File Path Vulnerability in WP Photo Album Plus Plugin by WordPress
CVE-2026-18048

Currently unrated

Key Information:

Vendor

WordPress
Status
WP Photo Album Plus
Vendor
CVE Published:
12 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-18048?

The WP Photo Album Plus plugin for WordPress has a significant security issue that arises from its failure to validate user-controlled input when constructing file paths. This vulnerability allows unauthenticated attackers to execute arbitrary deletion commands on ZIP archives stored on the server, including those that are located outside the standard web root directory. Consequently, attackers can exploit this flaw to delete critical files, which could lead to a loss of data and potentially devastating consequences for affected websites.

Affected Version(s)

WP Photo Album Plus 0 < 9.2.07.002

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-18048 - Proof of Concept

References

https://wpscan.com/vulnerability/fbc145d3-a582-4975-bc6b-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Erwan LR (WPScan)
WPScan
.