# CVE-2026-110983: WP Photo Album Plus CSRF in comment deletion

Source: https://junglewise.ai/threats/cve-2026-110983-the-wp-photo-album-plus-wordpress-plugin-before-9-3-04-004-does  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-110983 · Severity: info · Published 2026-10-29

WP Photo Album Plus is a WordPress plugin that manages photo albums and their comments. The plugin fails to validate request origins or security tokens when processing comment-deletion requests, allowing attackers to trick logged-in administrators into deleting photo comments by visiting a malicious page. An attacker with no direct access to the site could manipulate comment moderation and degrade user experience.

Technologies: [WP Photo Album Plus](https://junglewise.ai/threats/technologies/photo-album-plus). Vendors: [WP Photo Album Plus](https://junglewise.ai/threats/vendors/wp-photo-album-plus).

## Quick answers

**Is CVE-2026-110983 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110983 being exploited in the wild.

**How severe is CVE-2026-110983?** Informational severity, published 29 October 2026.

**Which products and versions are affected?** WP Photo Album Plus before 9.3.04.004.

**Is there a fix for CVE-2026-110983?** Yes: fixed in 9.3.04.004. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110983 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-110983?** Check whether you run WP Photo Album Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 9.3.04.004

## Technical details

The plugin lacks CSRF (Cross-Site Request Forgery) protection on a comment-management endpoint, specifically a comment deletion function. An attacker can craft a page that triggers a deletion request when viewed by an authenticated user with comment-moderation privileges, exploiting the absence of nonce or origin verification. The attack requires social engineering to trick a moderator into visiting the malicious page.

## Affected products

- WP Photo Album Plus WP Photo Album Plus before 9.3.04.004

## Timeline

- 2026-10-27: disclosed
- 2026-10-29: advisory

## References

- [https://wpscan.com/vulnerability/3375c88c-7f61-47d6-b9e0-76ad86ce1800/](https://wpscan.com/vulnerability/3375c88c-7f61-47d6-b9e0-76ad86ce1800/)

## Related threats

- [WP Photo Album Plus reflected XSS in category navigation](https://junglewise.ai/threats/cve-2026-110981-the-wp-photo-album-plus-wordpress-plugin-before-9-2-11-002-does)
- [WP Photo Album Plus authenticated command injection via ImageMagick](https://junglewise.ai/threats/cve-2026-92115-the-wp-photo-album-plus-plugin-for-wordpress-is-vulnerable-to)
- [WP Photo Album Plus stored XSS via X-Forwarded-For parameter](https://junglewise.ai/threats/cve-2026-18579-wp-photo-album-plus-stored-xss-via-x-forwarded-for-parameter)
- [WP Photo Album Plus privilege escalation in file upload](https://junglewise.ai/threats/cve-2026-18962-wp-photo-album-plus-privilege-escalation-in-file-upload)
- [WordPress WP Photo Album Plus unauthenticated option disclosure](https://junglewise.ai/threats/cve-2026-18049-wordpress-wp-photo-album-plus-unauthenticated-option-disclosure)