What is GHSA-v9qq-4jqv-3fxp?

GHSA-v9qq-4jqv-3fxp is a security advisory published by GitHub Security Advisories with Medium severity. The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or...

Which CVE IDs does GHSA-v9qq-4jqv-3fxp cover?

GHSA-v9qq-4jqv-3fxp covers the following CVE IDs: CVE-2026-17014. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v9qq-4jqv-3fxp?

GHSA-v9qq-4jqv-3fxp has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-v9qq-4jqv-3fxpMediumCVSS 5.3

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or...

Vendor

GitHub Security Advisories

Published

August 9, 2026

Last Modified

August 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-17014 →

📋 Description

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-17014
https://wpscan.com/vulnerability/d45c05bb-9c9f-4ed0-b02e-f683a56ba0e1
https://github.com/advisories/GHSA-v9qq-4jqv-3fxp