Executive brief
WP Photo Album Plus is a popular WordPress plugin for managing photo galleries and albums. An unauthenticated attacker can exploit a missing authorization check to read sensitive configuration options stored in the WordPress database, including credentials, API keys, and other autoloaded settings not owned by the plugin. This disclosure allows adversaries to extract information that could lead to further compromise of the WordPress site and hosting infrastructure.
Technical details
The vulnerability is an authorization bypass (CWE-200) in the plugin's REST API endpoint. The "gettogo" action does not validate user capabilities or nonce tokens, and it constructs option names from unsanitized client input without restricting lookups to the plugin's own namespace. An unauthenticated attacker can send a crafted REST API request to wp-json/wp-photo-album-plus/endPoint/?action=gettogo&togo=SUFFIX to retrieve any autoloaded WordPress option whose name ends in the supplied suffix. The vulnerable code also deletes companion options on match. Fixed in version 9.2.07.002 and later.
Affected products
- WP Photo Album Plus WP Photo Album Plus before 9.2.07.002
Timeline
- 2026-08-10: disclosed
- 2026-08-12: patched: Fixed in version 9.2.07.002