Executive brief
WP Photo Album Plus is a WordPress plugin that allows galleries and photo albums to be embedded on websites. The plugin fails to verify user permissions when processing front-end photo uploads, allowing low-privileged users (such as Subscribers) to upload files into albums owned by administrators or other users. An attacker with a basic user account can add arbitrary photos to restricted albums without authorization, potentially defacing galleries or injecting malicious content into sensitive albums.
Technical details
This is an authorization bypass vulnerability (IDOR - Insecure Direct Object Reference) in the WP Photo Album Plus plugin's front-end upload handler. The plugin processes file uploads without validating whether the current user has permission to upload into the target album. An authenticated user can extract a publicly visible album crypt token and nonce from the gallery page and submit a POST request (to either the gallery page or admin-ajax.php) to upload files into any album, regardless of ownership or access restrictions. The vulnerability requires the plugin's front-end user upload feature to be explicitly enabled (not enabled by default). The issue is fixed in version 9.2.09.002 and later.
Affected products
- WP Photo Album Plus WP Photo Album Plus before 9.2.09.002
Timeline
- 2026-08-10: disclosed
- 2026-08-12: patched: version 9.2.09.002