CVE-2026-18048 WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal
Unauthenticated attackers can delete arbitrary ZIP files on the server via path traversal in WP Photo Album Plus.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-18048?
CVE-2026-18048 is a high-severity path traversal vulnerability in Unknown WP Photo Album Plus, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.
Weakness: CWE-73
Which versions are affected by CVE-2026-18048?
How do I fix CVE-2026-18048?
No fix has been published for CVE-2026-18048 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-18048 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-18048 exists.
Sources
Also known as GHSA-7qh7-857w-wvvg.