Description

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-12T06:19:29.380Z",
  "pubdate": "2026-08-12T06:19:29.380Z",
  "executiveSummary": "An arbitrary file deletion vulnerability exists in the WP Photo Album Plus WordPress plugin before version 9.2.07.002. The vulnerability stems from improper input validation and a lack of authorization checks within a public endpoint action that handles client-controlled values used in file path construction.\nUnauthenticated remote attackers can exploit this flaw to delete arbitrary ZIP archives located on the underlying server, including sensitive archives stored outside the designated web root.\nThe risk implication is high due to the potential for disruptive service degradation, data loss, or tampering with critical application and system archives. Exploitation requires network access to the target WordPress instance, but no authentication, user interaction, or prior privileges are required.\nOrganizations running vulnerable versions of the WP Photo Album Plus plugin are exposed to potential malicious deletion attacks targeting zip files across accessible filesystem directories.",
  "technicalDetails": "The vulnerability is rooted in an insecure design flaw within a public endpoint action exposed by the WP Photo Album Plus WordPress plugin. Specifically, the application processes a client-controlled input parameter without proper sanitization, validation, or path traversal checks, and uses this untrusted value directly to construct a target file path.\nFurthermore, the public endpoint fails to perform any authentication or authorization checks, allowing unauthenticated remote threat actors to interact directly with the vulnerable handler over the network.\nThe attack flow proceeds as follows: 1) An unauthenticated attacker crafts an HTTP request targeting the public endpoint action of the WP Photo Album Plus plugin. 2) The attacker supplies a malicious, client-controlled value designed to reference a specific ZIP archive within the request parameters. 3) The application accepts the input and constructs the file path without verifying whether the path falls within allowed operational boundaries or checking if the requester possesses administrative privileges. 4) The server processes the file deletion routine using the constructed path, resulting in the removal of the targeted ZIP archive from the filesystem.\nBecause the file path construction lacks proper validation and restriction mechanisms, the deletion routine is not constrained to the web root directory. Consequently, attackers can target and delete arbitrary ZIP archives stored anywhere on the server filesystem to which the web server user process has deletion permissions.\nThe affected product is the WP Photo Album Plus WordPress plugin, specifically all versions prior to 9.2.07.002. The vulnerable component is the public endpoint action responsible for processing client-supplied file paths for ZIP archives."
}