What is GHSA-q3rf-7cjg-vf9x?

GHSA-q3rf-7cjg-vf9x is a security advisory published by GitHub Security Advisories with Medium severity. The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user...

Which CVE IDs does GHSA-q3rf-7cjg-vf9x cover?

GHSA-q3rf-7cjg-vf9x covers the following CVE IDs: CVE-2026-18962. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q3rf-7cjg-vf9x?

GHSA-q3rf-7cjg-vf9x has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-q3rf-7cjg-vf9xMediumCVSS 4.3

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user...

Vendor

GitHub Security Advisories

Published

August 12, 2026

Last Modified

August 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-18962 →

📋 Description

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the WP Photo Album Plus WordPress plugin before 9.2.09.002's front-end user upload feature to be enabled, which is not the default.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-18962
https://wpscan.com/vulnerability/146079f7-d4e5-4f1e-a715-f681fc33ed6a
https://github.com/advisories/GHSA-q3rf-7cjg-vf9x