Description

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the WP Photo Album Plus WordPress plugin before 9.2.09.002's front-end user upload feature to be enabled, which is not the default.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T06:20:55.503Z",
  "pubdate": "2026-08-12T06:20:55.503Z",
  "executiveSummary": "An authorization bypass vulnerability exists within the WP Photo Album Plus WordPress plugin before version 9.2.09.002, specifically affecting its front-end media upload mechanism.\nThe vulnerability arises from a failure in access control enforcement during front-end upload processing, where the application omits validation checks to verify whether the currently authenticated user possesses explicit permissions to upload files into the specified target album.\nConsequently, any authenticated user possessing low-privilege roles, such as a Subscriber, can leverage this flaw to upload arbitrary files into albums owned by other users or administrators.\nSuccessful exploitation allows unauthorized file placement within restricted or foreign media repositories, potentially leading to content tampering, unauthorized data exposure, or chained attacks depending on subsequent media handling capabilities.\nPrerequisites for exploitation require the front-end user upload feature of the plugin to be actively enabled, which deviates from default installation configurations.\nThe risk implication is moderate to high depending on the sensitivity of target albums and the potential for leveraging uploaded files within the broader WordPress environment.",
  "technicalDetails": "The root cause of the vulnerability stems from missing authorization checks within the front-end upload processing logic of the WP Photo Album Plus WordPress plugin.\nWhen a user initiates a front-end upload request, the application processes the target album identifier supplied in the request parameters without validating whether the session owner holds administrative privileges or ownership rights over the designated destination album.\nAuthentication is required in the sense that the threat actor must possess an active user account on the target WordPress instance, typically restricted to a low-privilege role such as a Subscriber.\nHowever, the lack of granular privilege verification at the album level bypasses intended role-based restrictions, allowing low-privilege actors to interact with endpoints reserved for higher-privileged users or album owners.\nThe attack flow proceeds as follows: First, an attacker authenticates to the WordPress site with a low-privilege account like a Subscriber. Second, the attacker formulates an HTTP request targeted at the plugin's front-end upload functionality, supplying the identifier of an album owned by a different user or an administrator. Third, the plugin processes the file upload payload and deposits the file into the targeted album without confirming ownership or authorization. Finally, the file is successfully registered within the foreign album structure.\nNetwork exposure is defined by the web accessibility of the WordPress front-end interface where the upload feature is exposed.\nThe affected component is the front-end file upload subsystem of the WP Photo Album Plus WordPress plugin across all versions prior to 9.2.09.002, provided the front-end user upload feature has been explicitly enabled by a site administrator."
}