CVE-2026-17014: WP Photo Album Plus Auth Bypass Flaw

CVE-2026-17014 Overview

CVE-2026-17014 affects the WP Photo Album Plus WordPress plugin in versions before 9.2.07.002. The plugin exposes a public REST endpoint that performs neither a capability check nor a nonce verification on one of its actions. Unauthenticated remote attackers can invoke the endpoint to delete album export ZIP archives generated and stored by the plugin. The issue is tracked as a Missing Authorization weakness under CWE-73 (External Control of File Name or Path).

Critical Impact
Unauthenticated attackers can delete album export ZIP archives stored by the WP Photo Album Plus plugin, causing integrity loss for exported album data.

Affected Products

WP Photo Album Plus WordPress plugin versions before 9.2.07.002

Discovery Timeline

2026-08-09 - CVE-2026-17014 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-17014

Vulnerability Analysis

WP Photo Album Plus registers a public REST API endpoint that handles album export ZIP archive management. One of the endpoint actions accepts requests to delete generated export archives from the WordPress installation. The plugin fails to validate the caller's capability and does not verify a WordPress nonce before executing the delete action. Any unauthenticated client that can reach the WordPress REST API can invoke the action and remove archive files.

The practical outcome is limited to integrity impact on the plugin's own export artifacts. Confidentiality is not affected because no data is read back to the attacker, and availability of the WordPress site itself is not directly disrupted. Administrators, however, may lose exported album ZIP files that users or workflows depend on.

Root Cause

The root cause is a missing authorization check on a public REST route registered by the plugin. WordPress requires plugins to implement a permission_callback when registering REST routes with register_rest_route(). In the affected versions, the delete action for album export archives does not enforce a capability such as manage_options and does not call wp_verify_nonce() on the incoming request.

Attack Vector

Exploitation requires only network access to the target WordPress site. The attacker sends a crafted HTTP request to the vulnerable REST endpoint action targeting a generated album export ZIP archive. Because the endpoint accepts unauthenticated requests, no credentials, tokens, or user interaction are needed. The server processes the request and deletes the referenced archive file. Technical specifics of the endpoint parameters are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-17014

Indicators of Compromise

Unexpected deletion of album export ZIP archives from the plugin's uploads or export directory.
Anonymous HTTP requests to /wp-json/ REST routes associated with the WP Photo Album Plus plugin.
Access log entries showing unauthenticated POST or DELETE requests targeting plugin REST actions from unfamiliar source IP addresses.

Detection Strategies

Enable WordPress and web server access logging and alert on unauthenticated requests to plugin REST endpoints.
Baseline the file inventory of the album export directory and alert when archives disappear outside of administrator activity.
Use a web application firewall to log and inspect REST API traffic for anomalous patterns targeting the WP Photo Album Plus namespace.

Monitoring Recommendations

Forward WordPress access logs and file integrity events to a centralized logging platform for correlation.
Monitor for spikes in 4xx and 2xx responses on /wp-json/ paths tied to the plugin.
Track plugin version inventory across WordPress fleets and flag hosts still running versions below 9.2.07.002.

How to Mitigate CVE-2026-17014

Immediate Actions Required

Update WP Photo Album Plus to version 9.2.07.002 or later on all WordPress installations.
Audit the album export directory for missing archives and restore from backup where needed.
Review recent REST API access logs for unauthenticated calls to plugin endpoints.

Patch Information

The vendor addressed the issue in WP Photo Album Plus version 9.2.07.002. The fix adds capability and nonce verification to the affected REST endpoint action. Refer to the WPScan Vulnerability Report for advisory details and remediation guidance.

Workarounds

If immediate patching is not possible, deactivate the WP Photo Album Plus plugin until the upgrade can be applied.
Restrict access to the WordPress REST API for unauthenticated users via a web application firewall rule scoped to the plugin's REST namespace.
Regularly back up album export archives to a separate location so deletions can be reversed.

bash

# Example WAF rule concept: block unauthenticated requests to the plugin's REST namespace
# (Adapt the namespace and action names to those documented in the WPScan advisory)
SecRule REQUEST_URI "@rx ^/wp-json/wppa/" \
    "id:1017014,phase:1,deny,status:403,log,\
     msg:'Block unauthenticated WP Photo Album Plus REST access (CVE-2026-17014)',\
     chain"
    SecRule &REQUEST_HEADERS:Cookie "@eq 0"