CVE-2026-17014

The WP Photo Album Plus plugin for WordPress prior to version 9.2.07.002 is vulnerable due to a lack of capability and nonce checks on a public REST endpoint, enabling unauthenticated users to delete album export ZIP archives. This vulnerability poses a risk of unauthorized data manipulation, potentially disrupting users' access to their photo albums. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk.