Executive brief
WP Photo Album Plus is a popular WordPress plugin for managing and organizing photo galleries and creating downloadable archives. An unauthenticated attacker can delete arbitrary ZIP files on the server by exploiting a path traversal flaw in the plugin's public endpoint, potentially removing backup archives, user-generated downloads, and files stored outside the web root, without needing any credentials or user interaction.
Technical details
The vulnerability is a path traversal / arbitrary file deletion flaw in the WP Photo Album Plus plugin's REST endpoint. The delmyzip action fails to validate a client-supplied file path parameter (passed via the X-Forwarded-For header) before using it to construct a file system path, and performs no authorization checks. This allows an unauthenticated attacker to send a crafted REST API request with directory traversal sequences (e.g., ../../../) to delete arbitrary .zip files anywhere on the server, including those outside the web root. The attack requires the plugin's zips directory to exist and the target file to carry a .zip extension. Fixed in version 9.2.07.002.
Affected products
- Wordpress.org WP Photo Album Plus before 9.2.07.002
Timeline
- 2026-08-10: disclosed
- 2026-08-12: patched: Version 9.2.07.002 released