CVE-2026-18049 WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo
Unauthenticated attackers can read arbitrary autoloaded WordPress options via a missing capability check in the WP Photo Album Plus plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-18049?
CVE-2026-18049 is a high-severity vulnerability in Unknown WP Photo Album Plus, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.
Weakness: CWE-200
Which versions are affected by CVE-2026-18049?
How do I fix CVE-2026-18049?
No fix has been published for CVE-2026-18049 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-18049 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-18049 exists.
Sources
Also known as GHSA-8pjc-hhvr-vf36.