Quick answers
- Is CVE-2026-18962 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18962 being exploited in the wild.
- How severe is CVE-2026-18962?
- Medium severity, with a CVSS score of 4.3, published 12 August 2026.
- Which products and versions are affected?
- WP Photo Album Plus before 9.2.09.002.
- Is there a fix for CVE-2026-18962?
- A patch was published on 2026-08-12: version 9.2.09.002 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-18962 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-18962?
- Check whether you run WP Photo Album Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is an authorization bypass vulnerability (IDOR - Insecure Direct Object Reference) in the WP Photo Album Plus plugin's front-end upload handler. The plugin processes file uploads without validating whether the current user has permission to upload into the target album. An authenticated user can extract a publicly visible album crypt token and nonce from the gallery page and submit a POST request (to either the gallery page or admin-ajax.php) to upload files into any album, regardless of ownership or access restrictions. The vulnerability requires the plugin's front-end user upload feature to be explicitly enabled (not enabled by default). The issue is fixed in version 9.2.09.002 and later.
Affected products
- WP Photo Album Plus WP Photo Album Plus before 9.2.09.002
Timeline
- 2026-08-10: disclosed
- 2026-08-12: patched: version 9.2.09.002