CyberRota Analysis
AI-GeneratedThe WP Photo Album Plus plugin for WordPress prior to version 9.2.07.002 is vulnerable due to insufficient validation of client-controlled input used for file path construction, combined with a lack of authorization checks. This flaw allows unauthenticated attackers to delete arbitrary ZIP archives on the server, potentially affecting files stored outside the web root. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.