Description

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-12T06:19:34.650Z",
  "pubdate": "2026-08-12T06:19:34.650Z",
  "executiveSummary": "The WP Photo Album Plus WordPress plugin before version 9.2.07.002 suffers from an unauthenticated arbitrary option read vulnerability.\nThe flaw exists due to the lack of proper capability and cryptographic nonce checks on a public endpoint action.\nAdditionally, the application dynamically constructs an option name using a client-supplied value without restricting it to plugin-specific option spaces.\nUnauthenticated remote threat actors can exploit this vulnerability to read sensitive data stored within the WordPress database, specifically targeting autoloaded options whose names end in a matching suffix provided in the attack vector.\nThe impact of this vulnerability includes potential information disclosure of sensitive configuration parameters or credentials stored in autoloaded options.\nExploitation requires network access to the target WordPress instance and does not require any prior authentication or special privileges.",
  "technicalDetails": "The vulnerability resides within the WP Photo Album Plus WordPress plugin affecting versions prior to 9.2.07.002.\nThe root cause of the vulnerability is twofold: the complete absence of authorization controls (capability checks) and request forgery validation (nonce verification) on a public endpoint action, combined with unsafe dynamic option name construction.\nSpecifically, the plugin accepts a client-supplied value via a public endpoint and utilizes it to construct a database option name query without implementing adequate input sanitization, structural constraints, or namespace restriction to confine queries strictly to plugin-owned options.\nThe attack flow proceeds as follows: an unauthenticated remote attacker crafts an HTTP request targeting the vulnerable public endpoint action exposed by the plugin.\nThe attacker supplies a specific suffix value within the request payload.\nUpon receiving the request, the application processes the input without verifying the sender's privileges or session authenticity via a nonce.\nThe plugin subsequently queries the WordPress options table by constructing an option identifier dynamically from the client-supplied input.\nBecause the lookup mechanism fails to restrict the search space to options associated exclusively with WP Photo Album Plus, the database query evaluates against other autoloaded options that end in the matching suffix supplied by the attacker.\nThe application then retrieves the matching option value and inadvertently discloses it back to the unauthenticated client in the response.\nPost-exploitation impact is characterized by unauthorized information disclosure, allowing attackers to harvest sensitive configuration data, internal paths, security keys, or third-party integration secrets stored within the WordPress options table as autoloaded records matching the query criteria."
}