CVE-2026-18049CWE-200information-disclosure

CVE-2026-18049

High · published August 12, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
36.6
In the wild
Unconfirmed
What it is

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00434 · 36.6th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-08-12T10:19Z
References (1)
https://wpscan.com/vulnerability/ee7a93ff-95f2-48f6-9e35-2e518a28e2ab/ · [email protected]
EPSS history
Timeline
  • 12 AUG 06:00Z
    WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo
    cvelistv5